
The surprising security pitfalls of read receipts
www.vox.com
For a decade, my wifes read receipts have been on without her knowing it. She kept checking her phones settings to see if they were turned off, and they were. But every time I sent her a text, Id see that my message got delivered, and what time she read it. Suffice it to say, this led to some awkward moments.Read receipts are a sore spot for a lot of couples, friends, family members, employers really anyone who sends and receives text messages these days. It wasnt always like this. Just a few years ago, you could send a text and not expect the unwelcome and day-ruining reminder that the recipient had read but failed to respond to your message. But these days, bad manners isnt the only reason why read receipts are bad. They can be an invitation for scammers to target you. And while you can turn them off on iOS and Androids default messaging apps, you might even consider using an entirely different app for your day-to-day texting needs that allow you even more privacy protections.Seriously, though, stop using read receipts on any of your messaging apps. Turn them off. There is little upside to giving away this tiny clue about how youre spending your time and attention. There is plenty of upside to reverting to a more primitive form of communication where you send a text and have no idea what happens to it next. You might even find solace in not knowing if the message was read. Maybe it just got lost in cyberspace, and maybe you should move on with your day rather than fretting.It wasnt that long ago that this is how texting worked. The first text message was sent using SMS, or short message service, technology in 1992 it said Merry Christmas. Ten years later, we got MMS, or multimedia messaging service, which worked like SMS but with images, video, and audio files. Just a few years ago, you could send a text and not expect the unwelcome and day-ruining reminder that the recipient had read but failed to respond to your message. Although a similar feature existed on email, BlackBerry gets credit for the first read receipt on a text message in its BBM instant messaging service, which launched in 2005. At the time, you could not turn off read receipts there, and people quickly realized that it could be bad if their friends knew theyd read a message but had not replied. So BlackBerry forums filled up with tips and tricks to avoid this. Apple made the feature mainstream when it launched iMessage in 2011. It complicated the situation four years later, when it added the ability to send read receipts to certain people but not others. Rich communication services, or RCS, is a messaging protocol that started gaining widespread adoption in the years after iMessage launched, and it brought read receipts to most Android devices.So what is a read receipt? Its actually just a bit of metadata, or bits of information that describe other bits of information. In this case, that includes details about the text message, including the fact that it was opened and at what time. So when someone opens a message, that metadata bounces back to the original sender, whos notified that their message was read. There are also delivery receipts that tell the sender only that the message has reached the recipient (but not that its been read). These are common features in both default messaging apps as well as dedicated messaging platforms, like WhatsApp, Signal, and so on. Unfortunately, you cant turn off delivery receipts like read receipts which, once again, you should.You could argue that read receipts are good. And in some situations, Id agree with that. Parents texting teens, a boss texting an employee, a husband texting a spouse I can see how theres value in just knowing a message was seen and it doesnt create any awkwardness. In other social settings, however, it just creates dissonance.Were getting information that implies a response is forthcoming, and when one isnt, we feel slighted which only makes sense, because the receipt made it possible to even know. Jeffrey A. Hall, a communications studies professor at the University of Kansas, told me. It plays with our expectationsPut differently, a read receipt gets you excited about hearing back from a friend, and when you dont, youre understandably annoyed. If youve ever received a spam text and opened it, for instance, the bad actor on the other end of the exchange knows that youre a person.Theres a darker, more technical side to this. Because read receipts are lines of code that get exchanged between the sender and the recipient of the message, it can be exploited by hackers and scammers. If youve ever received a spam text and opened it, for instance, the bad actor on the other end of the exchange knows that youre a person and will likely target you with more spam texts.It gets worse. In a preprint paper from 2024, researchers from the University of Vienna described a worst-case scenario in which read receipts and delivery receipts which, again, cannot be turned off reveal private information about you and your device without your knowledge or consent. Potentially, youve even used these features yourself in a more harmless way and without any bad intentions, e.g., when your partner is on their way home in an unsafe neighborhood and you know theyre low on battery you could ping them with an arbitrary message and wait for successful delivery to see whether their phone is still on, Gabriel K. Gegenhuber, one of the papers authors, wrote to me in an email. Also, when you message somebody that is on a flight, you would later be notified about the exact time theyve landed.This approach even works in encrypted apps like WhatsApp and Signal. Things could get even worse if the details of your receipts ended up in the wrong hands.Both delivery and read receipts could be abused by people that are actually close to you, Gegenhuber said. Due to the information they leak, they could be used for stalking and intimate partner abuse.Turning off read receipts is an easy way to avoid both social faux pas and being targeted by scammers and other bad actors. Apple has good guides for turning them off on iPhones, iPads, and Macs, which include instructions for turning them off system-wide as well as for specific people. Google offers one switch to turn them off on Android devices, and heres a guide for that. Then it varies by app. Here are some helpful links for WhatsApp and Signal.You might also consider just ditching the default messaging app on your phone altogether and using one of those third-party apps. Signal, in particular, is an app I like. Its end-to-end encrypted, private by default, run by a nonprofit, and free. You can also expect to avoid spam on it.When someone on Signal receives a message from someone for the first time, they encounter what we call a message request screen, Jun Harada, vice president of partnerships and growth at Signal, told me. That way you can see whats in the message without being able to accidentally click a link or open a file, and without worrying about what information they might be sending back to the sender, Hurada says. In the process of reporting this story, I did manage to figure out why my wife kept getting read receipts for me and me alone. Shed somehow turned them off for everyone else, but I was the last holdout. Now my read receipt privilege has been revoked but you know, Im fine with that.A version of this story was also published in the Vox Technology newsletter. Sign up here so you dont miss the next one!See More:
0 Σχόλια
·0 Μοιράστηκε
·74 Views