Why SMS is Insecure, and 6 Hidden macOS Features – Intego Mac Podcast Episode 308
Posted on
by
Kirk McElhearn
SMS is a popular text messaging system, but it’s not secure. We take a deep dive into how SMS works, and how to use it. We also look at six features of macOS that you may never have discovered.
If you like the Intego Mac Podcast, be sure to rate and review it on Apple Podcasts.
Have a question? Ask us! Contact Intego via email if you have any questions you want to hear discussed on the podcast, or to provide feedback and ideas for upcoming podcast episodes.
Transcript of Intego Mac Podcast episode 308
Voice Over 0:00
This is the Intego Mac Podcast—the voice of Mac security—for Thursday, September 7, 2023.
This week, we have a special episode featuring our roundup of six cool Mac features you may not know about, and an overview of SMS, the venerable messaging service, how and why SMS is still used, and why it’s not going anywhere. Now, here are the hosts of the Intego Mac podcast, veteran Mac journalist, Kirk McElhearn. And Intego’s chief security analyst, Josh Long.
Kirk McElhearn 0:39
Good morning, Josh. How are you today?
Josh Long 0:41
I’m doing well. How are you?
Apple is rumored to stop selling leather cases for iPhone
Kirk McElhearn 0:42
I’m okay. It’s the calm before the storm. This is the week before Apple’s event where they’re gonna present the iPhone 15. And other things. We talked about it in the last episode. We did want to add one more bit of information that we didn’t mention in last week’s episode. There have been what seemed to be reliable rumors that Apple will stop selling leather cases for the iPhone. Now just before we started recording, Josh and I were discussing, we’ve had different experiences. I had a leather case once from Apple didn’t last a year, I had a silicone case once from Apple didn’t last a year. With my iPhone 13. I bought their clear MagSafe case. So it’s a kind of a hard plastic. It’s got the white circle and the line on the back. This year, I have a case from Peak Design. It’s also MagSafe. Peak Design is a company that makes camera straps and bags and tripods, etc. But leather. Why are they getting rid of leather? Well, for all the environmental reasons that Apple is going to claim, even though the leather cases aren’t that good, they’re gonna claim what we’re doing this because it’s vegan, right?
Josh Long 1:41
I assume so. Yeah. So my experience with leather cases is I had a friend who gave me as a hand me down, he wasn’t using it anymore, his Product Red leather case for the iPhone XS, which was my previous phone before I upgraded to the 14 Pro. I loved that case, that was probably my favorite case that I’ve ever had. And then after upgrading to the 14 Pro, I thought, okay, cool. Well, I’ll buy the Apple leather case. Yeah, it’s expensive, but you know, it’s gonna be worth it. And I get it, I put it on. And I’m like, wow, this is not the same quality as the case that I had on my XS. And so I immediately returned it and bought a silicone case from a third party instead. And I’ve been really happy with it. So my experience is that I feel like the quality of the leather cases based on that experience that I had anyway, has gone down in recent years. And so I personally don’t think it’s that big of a deal that they’re getting rid of their leather cases, because I don’t feel like the current leather cases are very good anyway.
Six cool MacOS features you probably don’t know about
Kirk McElhearn 2:43
So this week, we wanted to talk about six cool MacOS features you probably don’t know about. Because, you know, everyone talks about the I want to say the high profile features, the marquee features, but there are lots of smaller features that, well, make my life easier. I wrote this article a couple of weeks ago. It’s kind of interesting, because when Josh read the article, he found a couple that he didn’t know and some other people I know reading the article said, Hey, I didn’t know about that. So it’s a good idea to highlight these six features that can make your life easier. The first one is zoom your display. Now I’m at the age that my eyesight is not great. And I zoom in the fonts, Command plus (+) can make fonts bigger, most of the time, but not all the time. There is a way to press and hold the modifier key and then scroll either with a mouse or a trackpad to zoom the entire display. I probably use this a dozen times a day because I can’t always zoom webpages and it’s just something I want to look at. And at the end of the day, I’m tired, and it just makes life easier.
Josh Long 3:42
Oh, yeah, totally agree. This is one of my favorite features on the Mac. I have an Apple Magic Mouse and being able to just hold Control and scroll on you know, you know, slide my finger up the Magic Mouse and zoom in on something is so so useful. I also use this like multiple times a day for sure. So definitely a feature that I strongly recommend. This can also be really useful if you’re giving a presentation too. Because sometimes something in your presentation might be kind of small might be difficult for people on the other end of the room to read. And guess what you can do this even if your Mac is connected to a projector or something so you can help people in the back of the room and see some little thing that you’re trying to point out to which is super useful.
Kirk McElhearn 4:29
Okay, so there’s a feature that you didn’t know about. And in fact, it was the impetus for this article you said wow, are there any other cool features that I don’t know about? It’s using background sounds on the Mac to provide ambience. My background sound is either the quiet of the farm fields around me and the chirping birds or music, right? Music in the background is good, but you can put things like rain sounds and ocean and streams and white noise and a lot of people like to do this because it is a way to sort of zoom out of all the rest of the noise around you. If you’re in a noisy environment, or if you want to put headphones on and not listen to music, then this is really useful.
Josh Long 5:07
This is one that I had absolutely no idea existed. I’d never heard of this before. And you’ll notice, by the way, that some of these things that we’re pointing out here are in the Accessibility Settings. So there are some specific reasons why you might want some of these things. Apple says for this particular feature, the background sounds, it says plays background sounds to mask unwanted environmental noise, these sounds can minimize distractions and help you focus calm or rest. So could be kind of useful. I’ve never tried this, but kind of clever. Yeah, and if again, if you maybe you’re not the person who likes listening to music, maybe you don’t, you know, there’s not some particular bit of music that you enjoy listening to, to help you relax, and maybe some of these calm, calming sounds, you don’t necessarily need to go download an iPhone app for that you can have those built into your Mac.
Kirk McElhearn 5:58
Decades ago, I had a one hour CD of birdsongs in a forest. And it was just so wonderful, I would just put this on every now and then it was so great. I didn’t live in a rural area within a town at the time. I really do like this stuff. Now. I think the sounds that are built into the Mac are kind of fake. But if you have an Apple Music subscription, or Spotify or any other streaming service, look for nature sounds and you’ll find a whole lot of sounds that are you know, much more interesting. And you’ll find if you go on YouTube, you’ll find like eight hour nature sound videos that you can play in the background as well. So here’s a feature that I have been using for I want to say almost as long as I’ve been using Macs. I remember the first dictation software I bought which was called Via Voice by IBM. It was what was called a discrete dictation system. You had to say each word one at a time with spaces. It was really rudimentary, you couldn’t say phrases. You couldn’t punctuate. It was really slow. But I’ve always been interested in this particularly because back in the day, I worked as a translator for many years. And I had to churn out lots of stuff and it wasn’t interesting stuff. And dictation was a good way to do this without struggling without the stress of typing right. I use it a lot. Apple’s dictation has gotten a lot better. A few years ago, Dragon, the company that makes Naturally Speaking, stopped providing a macOS app, and Apple, which I think uses Dragon’s technology for this. I know that Dragon powers Siri. They built in a really good dictation feature into the Mac into iOS and iPadOS. Now, iOS and iPadOS have an Enhanced Dictation feature where you can dictate and type, which means that you dictate a few words you type a few you keep dictating. If you do that on the Mac, once you start typing, it cancels the dictation. But with MacOS Sonoma, you’re gonna get that new dictation software. I use this for my work. Sometimes I’m just sitting back with my arms crossed talking into a microphone, dictating a few paragraphs of an article, which is a rough draft. And there are mistakes, it’s 95% accurate. But it’s such a relaxing way to work.
Josh Long 8:05
I have not personally used this on the Mac, but I use this all the time. Voice dictation is super helpful on my iPhone. And that’s where I usually use this feature. And it’s mostly when I’m like writing a text message or something. Again, you know, if it’s something that doesn’t really need to be proof read or or corrected or anything like that afterward. Sometimes I even use this on my Apple Watch. Although the problem there is it’s much more difficult to correct errors if you do need to correct something so, but I use this a lot on the iPhone. And I can definitely see why some people might want to use this on a Mac. I don’t remember… there was some weird reason that I turned this off on the Mac. But maybe I’ll consider turning it back on because I think this could actually be kind of useful for me too.
Kirk McElhearn 8:46
It’s really important on the iPhone because of the tiny keyboard and the fact that it’s not a keyboard with keys, right, you don’t get the feedback, I touch type. And I can type pretty quickly about 80 words per minute. But I still find it more relaxing to dictate and it’s free-er. You have to learn to dictate. It’s a skill that you have to learn. But it’s really useful.
Josh Long 9:05
Yeah, and it’s really not that difficult either. You can just add things in like comma, period, open quote, close quote, it will add all those things in for you. So you just speak the punctuation that you want. And Apple does a really good job of interpreting that.
Kirk McElhearn 9:20
I’ll put a link in the show notes to an article I wrote for TidBITS a few years ago about how to dictate about the process about the kinds of things you need to know. Basically, you need to speak like a newsreader on network television. Not too fast, annunciating clearly. Anyway, check out that article. It’s useful. Number four is flash the screen when an alert sound occurs. You know, sometimes I do like loud music, listening to some live Grateful Dead concerts and if there’s an alert on my Mac, and I click something and it’s not working, I don’t hear the little alert beep right because the alert sounds come out of my iMac not out of my stereo that the music comes out of. So there’s an option, again in the Accessibility Settings, to flash the screen when an alert sound occurs. Basically, screen just does a quick white flash. And if you want to silence your Mac, or if you’re listening to music, really practical.
Josh Long 10:15
This is something that I knew existed on the iPhone. And I don’t think I was really aware that this was also on the Mac, but it doesn’t make sense too. And I think, again, the reason why this is under Accessibility is because, for example, maybe your hard of hearing and so you may not necessarily hear those alert sounds. And so I think that’s why this kind of gets buried into Accessibility. But this can be really helpful. If, for example, you tend to have your volume down really low, maybe you’re, you know, in a lot of meetings, and you don’t want background noises, like you know, email alerts, and things like that coming in and interrupting your meetings. So you maybe you have your volume turned down really low or muted a lot of the time. And this can be really helpful in that scenario too.
Kirk McElhearn 10:55
Okay, shake the mouse pointer to locate it. And this is another Accessibility feature. The default mouse pointer is really small. So if you look in this article, you’ll see that you can also adjust the size of the pointer in the Accessibility Settings, which I do. Mine is set up about, let’s see one and a half notches above normal. But sometimes your pointer is against something that’s really busy and you can’t find it, you just shake your mouse and it gets really big gets to like a couple inches big. And then it shrinks down again.
Josh Long 11:25
If you have multiple displays, too, that can make it even more difficult to find this tiny cursor somewhere on your screen. And so I’ve found this to be helpful, I use this feature. And you suggested in your article that you might want to experiment with just increasing the cursor size. And that’s not really something that I’d ever really thought of doing. And I didn’t think I would like it. But I did increase it just a little bit. And I ended up leaving it that way. I really liked it.
Kirk McElhearn 11:50
Yeah, I’ve been doing that for as long as I’ve been able to do that. In fact, I probably had some sort of extension on Mac OS 9 that allowed me to do that back in the day. (Yeah, yeah.) The final one. And this is kind of interesting, because there are security and privacy implications to this. It’s unlock your Mac with your Apple Watch. We’ve probably discussed this in the past, this has been part of macOS and watchOS for several years. I have a iMac with Touch ID, I have a MacBook Air with Touch ID. But before that, it’s really hassle type the password each time. And especially if you have a long secure password, it’s a real hassle. So if you unlock with the Apple Watch, now, you have to have two factor authentication turned on. Both devices have to be signed into the same Apple ID. And you press any key on the keyboard and, boom, the Mac wakes up. But there’s a problem. You see, the reason I turned it off on my iMac is because my home office is on the ground floor and the master bedroom was just above it. And a couple of times I got notifications on my watch that my iMac was being unlocked when I was upstairs in the bedroom. I’ve got cats, a cat can walk on a keyboard. And if the watch is close enough, it’ll unlock the Mac. Now I’m not worried that the cats are going to access my bank account. But if you are in a situation, imagine you’re in an office, and you step away, and you lock your Mac and your Mac is set to unlock with your watch. You step away and someone can tap the keyboard if you’re within 30 feet or so it can unlock so useful but careful.
Josh Long 13:19
Exactly. Yeah. And that’s exactly why I don’t use this feature. (But you don’t have cats.) No, I don’t have cats. No, but I, I’m uncomfortable with the idea that if I’m somewhere in the vicinity of my MacBook, I might not actually be able to see my MacBook, I might be in the next room. And I’m just close enough that it’s going to unlock if somebody else were to walk up to it. I don’t have too many personal concerns about this. But if I were in an office environment where I might not necessarily trust all of my coworkers, I definitely would not want to use that functionality in that scenario.
Kirk McElhearn 13:53
Or if you’re staying in a hotel, and the evil maid comes in and you’re in the other room doing something and, boom. Now you do get a notification on your watch. You get haptic feedback, and it will warn you but it’s still it’s just not a good idea.
Josh Long 14:07
It gives you a little tap on the wrist. But you may not necessarily notice it or you might even assume that that’s some other alert and so you just don’t really pay attention to it. So it’s something to be to be aware of, but it can be useful in certain scenarios.
Kirk McElhearn 14:21
Okay, we’re gonna take a break. When we come back, we’re going to take a deep dive into SMS, how it works, why it’s insecure and why we still need to use it.
Voice Over 14:30
Protecting your online security and privacy has never been more important than it is today. Intego has been proudly protecting Mac users for over 25 years. And our latest Mac protection suite includes the tools you need to stay protected. Intego’s Mac Premium Bundle X 9 includes Virus Barrier, the world’s best Mac anti-malware protection, Net Barrier, powerful inbound and outbound firewall security, Personal Backup to keep your important files safe from ransomware. And much more to help protect, secure and organize your Mac. Best of all, it’s compatible with macOS Ventura, and the latest Apple silicon Macs. Download the free trial of Mac Premium Bundle X 9 from intego.com today. When you’re ready to buy, Intego Mac Podcast listeners can get a special discount by using the link in this episode’s show notes at podcast.intego.com. That’s podcast.intego.com and click on this episode to find the Special Discount Link exclusively for Intego Mac Podcast listeners. Intego. World class protection and utility software for Mac users made by the Mac security experts.
What is SMS and why is it still used?
Kirk McElhearn 15:47
Okay, a few episodes ago, we had a brief discussion about SMS and that prompted Josh and I to consider an article discussing SMS in more depth. And we want to talk about that because, well, SMS is kind of the default way of messaging and it was for a long time, and a lot of people still think it is. I remember when mobile phones first came out in France, French people had a habit of right after midnight on New Year’s Day, texting all their friends to wish them a happy new year. And it would bring down the phone company’s network every year for the first few years because they just couldn’t handle all these millions of SMS. This is still the early days of mobile phones when not everyone had a mobile phone, but it just couldn’t handle all of them. SMS is cool, you can send a quick message to someone, you can get a six digit code to log into a website, you can connect to anyone, they don’t have to have a specific app. But of course, that’s part of its weakness, isn’t it?
Josh Long 16:41
Well, yeah, it can be a pro, you know it, as you say, it doesn’t really matter what phone you’re using any phone, even an old flip phone, it doesn’t have to be a smartphone, anybody can send an SMS. You can also have, there’s a lot of automated systems that will send a text message alert. Again, you can have any phone, any cellular phone can receive an SMS text message. So it’s convenient from that perspective. But the big drawback of SMS is that it was not designed with security in mind, there is no security whatsoever when sending an SMS text message. So wherever the source is, you know, it has to go through a variety of places to eventually get to you, right, it’s got to go through your cellular network, it’s got to go through your cell towers, and so forth. And once it finally gets to you, you just hope and assume that it probably has not been modified somewhere along the way.
Kirk McElhearn 17:39
SMS is kind of like email, email, unless you’re using specifically encrypted email services and specific apps. An email goes to a server goes to another server bounces around, and anyone could intercept it at any time. It’s not secure. SMSs go through what’s called a Short Message Service Center, and this server tries to deliver the message, but it may not be able to do so if your phone’s turned off. Or if you’re out of range of cellular service, it’ll try again later. So that means it’s still sitting around on that server could be for a day or two, before it finally gives up. So the thing about SMS is, it’s like a postcard. It’s not like a sealed letter. It’s really practical for a number of things. I get SMSs from my doctor, my dentist reminding that I have an appointment. No problem that that’s not secure. That’s not really privileged information. I get an SMS from my phone company saying my new bill is available. from my ISP saying my new bill is available. For all these things, it makes a lot of sense. It’s the vanilla messaging, isn’t it?
Josh Long 18:37
Yeah. And now I can imagine scenarios where somebody might trick you by sending you a fake message that looks very similar to the messages that you would expect to get related to your bill or an upcoming appointment or things like that. So one thing to be aware of is when you do get messages like that, just make sure that you don’t tap on a link in the message because very likely, if it contains a link, there’s a possibility that that could actually take you somewhere else. And not actually who you’re expecting it to be from maybe it’s actually a phishing message.
Speaker 4 19:15
You mean a smishing message? (Right. Exactly. Yeah.) So some people are saying that SMS is going to disappear. And I don’t think that’s going to happen for a number of reasons. First of all, SMS doesn’t require a data plan. It goes over a phone network, it’s not a data service. So you can have the dumbest of phones and still send SMS you don’t need a special app to do it. Another reason and this is something a lot of people don’t think, estimates say that by 2025, there will be more than 27 billion Internet of Things Edge devices around the world, many of which use SMS to communicate. Now Edge devices are things like sensors, tracking things that businesses use that if you’ve ever bought a tracker for your dog or your cat It uses SMS as it uses GPS. And it’s got a SIM card for SMS. But there’s a billions of these things, we don’t see them because they’re often in factories. So maybe you’ve got a factory assembly line. And there’s a little tracker that uses SMS that’s at some point that’s in the basket that’s carrying things around or whatever. SMS is incredibly common for all these devices. I was looking up some of the uses. And one of the interesting ones is SMS used to wake up remote devices like wildlife cameras. You may have seen these photos in the wild of, you know, there’s a camera catches a lion walking by or something. And these may not be on all the time, the people running the cameras can send SMSs to turn them on. You can use SMS to track your car. Now you can also buy a GPS tracker for your car. But SMS can communicate that information to you.
Josh Long 20:50
Right. Another thing I think a lot of people don’t think about when it comes to SMS is because it doesn’t use a data plan because it just, you know, piggybacks on messages that are already happening between your phone and the cellular tower is that this can be used in kind of emergency semi emergency situations, right, you can be in the middle of nowhere have absolutely no data connection whatsoever. But as long as you have just enough of a connection to a cell tower, you can sometimes still get SMS messages out where you can’t get a data message like for example, an iMessage. So I’ve seen this before, I don’t go camping a lot. But I have been in situations before where I’m in the mountain somewhere. And I just don’t have a good enough connection to send an iMessage and iMessage will actually fall back it by default. It has this functionality where the Apple Messages app can fall back to sending a text message a plain text message instead if the iMessage fails to go through. So I’ve been able to do that in the past in places where I had basically no data availability whatsoever, I was still able to get a message out.
Kirk McElhearn 22:03
SMS is also used for a service called advanced mobile location, which is mandated by the European Union, which is used for emergency calls from a phone. So when you use the emergency feature on your phone, I’m not talking about Emergency SOS, the new one that uses satellite, but the basic emergency feature, if you don’t have a data connection, it will be able to send you location to emergency services. Now, the big problem of SMS is that it’s not secure. And we mentioned this earlier, and I mentioned those six digit codes that you get sent to log into a website and is it safe? Josh’s shaking his head. No, it’s not safe.
Josh Long 22:38
Well, no. Okay. So here’s the thing on that. If you have other options for two factor authentication, then I would suggest always choose some other option if your other options are, for example, to set up an authenticator app, maybe Google Authenticator or Microsoft has an authenticator app. And in fact, even iCloud has that functionality built in now, for the past couple of versions of iOS and macOS, you’ve been able to get these two factor codes, also using the iCloud password management functionality. So in many other password managers, I know Kirk, you use One Password, and that has that functionality built in as well. So there’s many, many apps that you can use to get these one time codes. And that’s a much, much more secure way than receiving a text message with a one time code. So I always prefer to choose one of those other options. Now, some online services don’t give you any two factor option besides SMS. And in those scenarios, generally speaking, and I’m putting a caveat there for a reason that I’ll get back to but generally speaking, SMS, if that’s your only two factor option, I think that’s fine to do. And it’s better than just using a password to log in. Now, the one little caveat to that is that some services may not really be designed with security in mind. And sometimes they will allow you to recover access to your entire account only using your cell phone and getting a text message. Now, that’s not secure, because as we’ll talk about, there are a lot of ways that somebody could potentially intercept that text message intended for you and now hack into your accounts.
Kirk McElhearn 24:28
One thing to keep in mind is to never give these codes to someone because you could get a scammer who’s calling you pretending to be your bank and says, go to login and give me the code. What that means is they have your username and your password, and they’re going to use that code to get access to your account, change your password, so you can’t do it, and then empty your account or do whatever they want with it. So you should never give these codes to anyone.
Josh Long 24:50
And a side note on that. That can even happen if you’re using an authenticator app too. If you’re talking to a scammer, they might try to get you to reveal the code from your app as well.
Kirk McElhearn 24:59
So what about RCS we talked about RCS in episode number 252. That was more than a year ago wasn’t it? Google begs Apple to replace iMessage. With RCS. So RCS is a protocol called Rich Communication Services. It’s the default method for messages on Android on Google. RCS is a bit complicated. It kind of works like iMessage. But it’s not really the same. And there’s no compatibility between iMessage and RCS, even though Google wants Apple to adopt RCS
Josh Long 25:32
Right. So there’s a lot of details about RCS that we’re not going to get into on this episode, just because we want to keep this concise. But the main thing to know is that Android has RCS, and iPhones have iMessage. And so if you’re communicating from Android to Android, you can do that secure end-to-end encrypted using RCS. And if you’re on an iPhone, you can do the same thing with other iPhone users over iMessage. But there’s because there’s no compatibility between them, that means that anytime an Android user texts an iPhone user, or an iPhone user texts an Android user, that’s always going over SMS or sometimes MMS, which is basically the equivalent but designed for multimedia and longer messages and things like that, but insecure either way. So that’s a kind of a problem. Because this also means that group messaging if, for example, your entire family uses an iPhone, except for one person who uses an Android phone, that one person is going to mess everything up. And now, it’s not a group iMessage anymore. Now it has to be a group SMS, which some people find really annoying, because that means that all of the iMessage exclusive functionalities not really going to work very well over those kinds of conversations. So what I think that Apple could do, and I don’t think I had this perspective back over a year ago, when we originally talked about RCS, but as I’ve been thinking about this recently, I think that it actually probably would be in everyone’s best interest for Apple to implement RCS not as a replacement for iMessage. But specifically for those use cases. So being able to send a green, it can still even have the green bubbles, right? Everyone complains, like when they have to when they get a green bubble, right? When they’re texting somebody that means it’s an Android user, right? I don’t know why people get so upset about this. But yeah, Apple can still use the green bubbles. Even if they implemented RCS, they can still have green bubbles to indicate that you’re not getting all of the extra functionality of iMessage, but still have that be a secure end-to-end encrypted communication. So I actually think that it would be nice for Apple to implement RCS just for that reason, Apple claims to be the company that’s all about privacy, right? So why wouldn’t they want your communications with everybody to be private and secure?
Kirk McElhearn 28:09
Okay, I don’t think SMS is going away anytime soon. As I mentioned all the IoT Edge devices using it, all of the reasons why it works without a data connection, and it’s easy to send. So SMS is here forever. It’s not encrypted. So don’t send any sensitive information via SMS. And just be aware of the pros and cons of using SMS. Next week, what are we going to talk about Josh?
Josh Long 28:33
Well, I’m pretty sure that we’re going to be talking about the Apple Event and all the things that Apple has announced because we’re going to be recording just after September 12, right after the Apple Event. So there’s going to be a lot of new information about the latest iPhones and we’ll see what else.
Kirk McElhearn 28:52
Okay, until next week, Josh, stay secure.
Josh Long 28:56
All right, stay secure.
Voice Over 28:57
Thanks for listening to the Intego Mac Podcast, the voice of Mac security, with your hosts Kirk McElhearn and Josh Long. To get every weekly episode, be sure to follow us on Apple Podcasts, or subscribe in your favorite podcast app. And, if you can, leave a rating, a like, or a review. Links to topics and information mentioned in the podcast can be found in the show notes for the episode at podcast.intego.com The Intego website is also where to find details on the full line of Intego security and utility software: intego.com.
