Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

So you scripted sending the message to 84 different numbers, was that from your own personal iMessage account?

I would be terrified of doing something like that, I imagine the account could get flagged for spam, and hearing the various tech horror stories, I wouldn’t be surprised if it could end up suspending your iCloud account with everything on it, blacklisting hardware devices linked to it, and who knows what else.



This once happened to somebody I know! Their Apple ID somehow got banned from specifically, and only, iMessage and FaceTime; all other services like iCloud and the app store were working as usual.

No idea why it happened, but Apple support was able to reset it on a phone call.

My theory is that they'd kept a non-active SIM in their phone for a long time, and the phone had tried to repeatedly verify/link that phone number to their Apple ID (via challenge SMS, I believe), thereby exceeding some rate limit.

Gotta love that such rate limits exist and do occasionally hit legitimate users, but at the same time, there are paid lookup-as-a-service APIs out there as mentioned in TFA...


> specifically, and only, iMessage and FaceTime; all other services like iCloud and the app store were working as usual

Google should take note.


> Apple support was able to reset it on a phone call.

That too.


Apple's phone support is insane, at least where I used it.

High audio quality, no rush and no signs of them being an underpaid call center operator, always going the extra mile to help me.


must be location dependent. i've only ever had the standard 3rd world country script support employees, but they do tend to eventually transfer me to an irish guy who is allowed to speak freely after enough going around in circles.


I never used the support in an english-speaking country, so that might indeed explain my experience.


I had to use support for some purchases on the iTunes music store, and if I remember correctly, the support options offered on the homepage varied depending on which language I had set. I think the "write a message describing your problem" option for example was only available in English, and you had to play around a little with the possible options of categorising your problem to get it to appear.

But past that hurdle, at least my actual problems got resolved satisfactorily.


Yep, we had to contact Apple support maybe three times since we switched to Apple products in 2007. It was easy to get hold of them every time and they were very pleasant.

The last time there was an issue with an Apple Care payment. I was forwarded to someone who I believe was actually in Apple’s Dutch accounting department (certainly not a help desk drone). They called me back to follow up and even after everything was sorted out to check if everything was looking good on my end.


Well you're paying for it, the app store fees alone make it worth while for Apple. I do wonder, with the changes slowly trickling down the pipe, will Apple's fees over then next few years slowly diminish? And if so, what of their support quality (which is financed via funds from app store fees)?


Yep, you are paying for it. But with Google Android you pay with your privacy and time. And you get terrible support in return.

I've been trying to get a paid game the past days for my kids, a game where you try use bolts to remove wooden planks. It only exists with IAP and/or ads. The ads are terrible and not tailored to children. Nor are all the dark patterns. And you can get rid of the ads. By paying you get rid of them!!.. for 24 hours.

I'd rather pay via App Store or Google Play Store or Steam or whatever. Even a subscription for a month would've been better.


FWIW there is the Google Play Pass which gets you 1000+ games without any ads or the need for additional in-app purchases. It can be shared with 5 family members too.


Don't the Play Store and the App Store take exactly the same cut in most cases?


I don't think I have bought an App in the AppStore in years, so the only money they're getting for me was from the device I buy every 5 years or so.


Phone support for devices usually ends a couple of months after the purchase date as far as I know, or has that changed?


I never had to give serial numbers or anything when calling, so I don't think they know/care?

Even at the Apple Store, they help with out-of-warranty items all the time. I recently gave away an iPhone 8 and they helped my friend setup.

A nice woman there gave me new rubber-thingies for my AirPods and it's been out of warranty for the longest time. I mean they never checked or anything.


It's been a long while, but I scripted iMessage a bit, and Apple has a pretty casual slide into unworking.

They don't just block your account in one fell swoop, first indicators and messaging will stop working for a few hours. And you can hit that at least a few times without a ban. After a few times of that it was clear it wouldn't be worth running what I had, so I stopped before any sort of permanent banning.


Is 84 so high? I imagine there are people sending party invites and “lost my phone, new number” messages to more than that.


I think more than sending 84 messages, getting reported on handful of them can be more concerning. While you’ll rarely get reported for a party invite.


Yeah, exactly. I’m not sure what happens after I click “Delete and Report Junk” on every spammy-looking sms and iMessage I get, but I imagine the iMessage reports go into some ML blackbox and hopefully contribute to banning the spammer.

I understand the op was trying to do a good deed, but if I saw an unexpected message like that I would definitely hit “Delete and Report Junk” instead of just “Delete”.


Why would you consider the text spammy? No links or requests were included. So just delete seems fine to me.


Maybe I’m just jaded/untrusting, but the message reminded me of the initial opening text from various wrongnumber/pig-butchering scams.

https://maxread.substack.com/p/whats-the-deal-with-all-those...

Discussion of above - https://news.ycombinator.com/item?id=31949731


I'm not the author but my guess is that the API returns whether the number is registered with iMessage or not- like if you type in a number in a new text message it shows whether the message you're sending will be an iMessage or a text message. Don't think the author was spamming random numbers.


The author said that they scripted sending the messages to those numbers on their Mac rather than using something like Twilio.


That’s after screening to see if the number was linked to iMessage —- ie a valid iPhone attached to the number. That’s what that lookup service did. Then they scripted messaging the numbers that worked.


Yes, and after screening they had 84 recipients to contact.


iMessage has an AppleScript API that makes it easy. I ran a game in school with something like 50 teams and I had a script to generate different objectives for each team and send them out by text automatically.


Yeah, I definitely should’ve thought it through more. I was just a little too caffeinated and excited.


So much for end to end encryption that is unreadable by Apple.


I do believe apple’s e2e encryption promises on iMessage content, and don’t think it should interfere with their ability to control for spam / bad actors.

But I also expect them to know the sender/receiver, and I imagine if I click “Delete and Report Junk” button, that I would probably submit the unencrypted contents of that whole conversation to Apple. And they should have also have metrics of total sends vs reported sends.


The vast majority of iMessages (99%+), including normal/unreported ones, are readable by Apple because either the iMessages themselves or the iMessage cross-device sync keys are escrowed to Apple in the non-e2ee iCloud Backup. In the latter case the messages are readable in realtime.

This is documented (not the 99% figure, but the situation) by Apple in knowledge base articles on the apple.com website.

The e2ee in iMessage is effectively irrelevant, as for most people, most of the time, it functions just like Telegram (which is not e2ee).


Fair enough, though this is probably useful people for most non tech people, who might forget their passwords / lose keys, and don’t want to lose all access and data.

Personally, a few months ago I enabled Advanced Data Protection (ADP) which afaik does make iCloud backups (including messages), Photos, iCloud Drive and few other things inaccessible to Apple.

- https://support.apple.com/en-us/102651 - https://support.apple.com/guide/security/advanced-data-prote...

Whether you trust that Apple actually did throw away their keys after enabling the feature is a different story, but it’s good enough for me.

When enabling ADP there’s multiple warnings about how you’ll end up completely locked out if you lose all your devices / lose recovery keys / lose all hardware authenticators. Iirc I was also forced to register at least 2 yubikeys. For anyone tech savvy you should enable ADP.


In other apps like whatsapp reporting a message usually sends contents/history to mods explicitly. No need to break e2ee for that




Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: