Slashdot Mirror
Advertisers Already Using New iPhone Text Message Exploit
Andy Smith writes: The annoying App Store redirect issue has blighted iPhone users for years, but now there's a new annoyance and it's already being exploited: Visit a web page on your iPhone and any advertiser can automatically open your messages app and create a new text message with the recipient and message already filled in. We can only hope they don't figure out how to automatically send the message, although you can bet they're trying.
You'll forgive me if I dont click that
It's shit like that that drives people to adblock. And also to class action lawsuits.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
I know I'm an odd ball, cynical, and critical. As proof, I use my phone as a Phone and iPod. I didn't like Palm Pilots either, for some of the same reasons. The screen is too small, the keyboard sucks ass, and it's too slow. Phones added a new dimension though.. which is whether or not I trust a network my phone connects to that I can't see or audit.
You can do what ever you want on your phone in my opinion. The vendor should be responsible for teaching people risks, but risks are then up to the consumer. Want to play games, brows the web, use custom Social media apps all on a mobile device? Good for you. I don't, and won't, and am pretty happy with my decisions.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
Let's fine them $100k per infraction
It's not an "exploit"!
You've been "productized" and then "monetized".
So when will we start holding ad agencies accountable for what is basically hacking?
This is precisely why I will never have any qualms about blocking every damned ad site I can possibly identify ... because they're all ran by assholes who feel entitled to do anything they wish.
They're untrustworthy, and willing to do anything for a buck. Which means we should be blocking the hell out of this shit.
Boo hoo to anybody who says they need the ad revenue ... unless you plan on being accountable for this shit done by your advertisers, stop expecting us to trust them or you.
Lost at C:>. Found at C.
Or they can just give us an option to disable Safari from doing anything other than web browsing.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Why is there an API for sending a text message from a web page? Why does this need to exist at all?
You'd think someone at Apple, when they came up for this idea for this, would be shot down by someone else saying "Sorry dude, this is a feature that can be abused."
Same deal with javascript being able to open the App Store. WHY??
Well, not a real war. I mean, it's just the Internet, so like a hacker war or something. And I'm probably not going to do anything about it. Don't know anything about hacking, personally But I'm sure someone somewhere out there will take up the torch! I just need a catchy hashtaggy thingy, and I guess I'd have to make a Twitter account? Wow, that sounds like a lot of work for a war. Uh, I guess someone else who already uses Twitter would have to do that part.
Anyway, I've done my part. It's now up to you, random outraged people of the Internet! Focus your anger and hatred into something positive and wage unholy war on these adver--what's that? 50% off penis enlargements and porn? HOW DO I HIT SEND FASTER!? AWAY!!
How is this different than a mailto: link which can populate the subject, body, etc. but not actually send it until you tap send?
In that case we'll all continue to run ad blockers until you guys are able to figure out which ads are good and which are bad. This fiasco should serve as motivation for the ad industry to start aggressively self-regulating, including funding action against rule breakers. They'll be the death of your industry if you allow them to continue.
Using the SMS URL scheme in Chrome on Android does the exact same thing. If any webpage has a link or uses Javascript to simulate a click to an SMS URL, it will bring up your default messaging app with a pre-populated phone number and optional message.
[a href="sms:+18005551234?body=hello%20there"]SMS Me[/a]
Like iOS, this does not automatically send the message. I don't know why this is not reported as being just a feature of modern browsers like the old mailto: tag. This is a feature, not an exploit. Whether or not it should even be a feature in the first place is another argument altogether.
If an ad is caught doing this the app gets pulled from the app store. Makes the advertising useless.
Yet another great reason to block all ads under all circumstances. You control what displays on your property, not some remote server! Give them a pixel, they'll take root if they can.
Apple has supported the "sms:" URL scheme on iOS for years now. Here's a site with a how-to from 2013.