iMessage users have a decision to make
It has been the tech story of the month, overshadowing the long-awaited releases of Apple’s iOS 18.2 and Samsung’s One UI 7 beta. The headlines are still coming, pushing advice on a user base now equal parts concerned and confused. And no platform is more confusing than iMessage—so here’s all you need to know about what is secure and what isn’t on iMessage, and why the warning means use something else.
“The FBI says your texts aren’t secure. Do you need to stop?” The Hill asked this weekend, at the same time as Android Central warned that while Google “shows a lack of respect for users inside its ecosystem,” but when it comes to the FBI’s new text warnings “Apple did the bare minimum because it doesn’t care about you either.”
You won’t need a recap, but just in case: Salt Typhoon, a hacking group linked to China’s Ministry of State Security, has infiltrated U.S. networks, harvesting call and message metadata from many users and content from some. The FBI has warned iPhone and Android users to stop using insecure SMS/RCS and to use encrypted platforms instead, albeit they’d rather those platforms shared content if they ask.
The FBI’s warning was aimed at U.S. citizens. Android outsells iPhone globally as much as 4:1, but not in the U.S., where iPhone still outsells Android and dominates key segments of the market—notably the young and those in higher wealth brackets. And so unsurprisingly, Newsweek framed the story as “why iPhone owners should stop texting Android users amid FBI warning.”
Apple’s messaging platform is not well understood. It is a front-end for iMessage—its end-to-end encrypted messaging protocol, but also the only SMS client available on iPhone. This was one of the criticisms in this year’s DOJ report into Apple’s walled garden. As of iOS 18, the Messages app also offers RCS as well, meaning it now works with three different message standards—iMessage, RCS and SMS.
Messaging between Apple users who have iMessage enabled and a live data connection is fully secured, as signified by those famous blue bubbles. Both SMS and RCS—whether transmitted over a data connection or not—are never fully secured, and so you will always see them marked by a green bubble.
The Messages app will use the most secure connection it can find—iMessage then RCS then SMS. While RCS is not fully secured, it is better than SMS. But to be frank, anything is better than SMS. But if one of the parties to a chat does not have a data connection or RCS/iMessage enabled, then the platform will automatically revert to SMS. You can stop iMessage failing over to text messages in settings, and you should. But if a user doesn’t have iMessage, then it will revert to text messaging anyway.
Critically, that setting doesn’t disable SMS it just prevents Messages automatically reverting to SMS in a chat with another Apple user because it can’t find a data path over which to send an iMessage. You can fully disable RCS, though; RCS, if enabled, will always revert to SMS if needed, the least secure option on the phone.
The real question isn’t whether to stop using iMessage, but whether to stop defaulting to Apple’s Messages app, the SMS/RCS/iMessage client on your phone. And yes, when the FBI advises iPhone users to stop texting Android users, you do need another app. And if you’re going to use another app—a fully encrypted app such as WhatsApp or Signal, then it will also be more secure for iPhone to iPhone texting, because it will always be encrypted and will never fail over to anything else.
“The FBI piping in to let everyone know there is a problem isn’t unexpected,” Android Central commented this weekend. “In fact, it’s the opposite, and I’m surprised it took so long.” This should have never happened. “Apple and Google could have, and should have, prevented this… Neither side cared about working together to help consumers like us because we were going to buy their [stuff] anyway.”
What should have happened is a joint effort between Apple and Google to bridge their two platforms securely, just as they did with covid contact tracing. But they didn’t. Waiting for a fix to the standard RCS protocol is pointless—too many moving parts, too many cooks and obstacles, too much that could go wrong.
“So what should you do? Android Central asks. “If you live outside the U.S. or Canada, you probably don’t have to do anything because you likely don’t even use Google Messages or iMessage.” Which takes us to the crux of this FBI warning.
As I’ve commented before, iMessage is really for U.S. users, the only key market in which it outstrips WhatsApp—at least for now. The rest of the world is already using over-the-top, mostly encrypted alternatives as their dailies. But the FBI warning was directed at Americans, who are more likely to be using iMessage than not. If you do use iMessage, then Android Central and others suggest “you should stop and switch to a secure and encrypted platform like the FBI says.”
You don’t yet have an option to completely quit iMessage, it will receive all your SMS OTPs and marketing texts after all, plus the odd SMS from an aging relative. But for your daily messaging, use a fully secure platform instead. At least until Apple and Google provide a cross-platform option of their own that does the same.
I have reached out to Apple for any comments on the FBI’s texting warning and the implications for their iPhone users base and iMessage platform.
One Community. Many Voices. Create a free account to share your thoughts.
Our community is about connecting people through open and thoughtful conversations. We want our readers to share their views and exchange ideas and facts in a safe space.
In order to do so, please follow the posting rules in our site’s Terms of Service. We’ve summarized some of those key rules below. Simply put, keep it civil.
Your post will be rejected if we notice that it seems to contain:
User accounts will be blocked if we notice or believe that users are engaged in:
So, how can you be a power user?
Thanks for reading our community guidelines. Please read the full list of posting rules found in our site’s Terms of Service.