Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Governments spying on Apple, Google users through push notifications

reuters.com

Post reply on HN
Print view View original

11–20 of 649 posts

Re: Governments spying on Apple, Google users through push notifications

#11

Post by bmelton »

jruohonen wrote: post #2

[flagged]

In what way would ignoring a viable SIGINT source be incompetent?

Just thinking about only my push notifications yesterday and they revealed that I am clearly a developer or technologist (push notifications from Git/AWS/etc), who got a haircut (time and location were revealed in the message, but I'm sure government-level agencies could have tracked which SportClips location the appointment belonged to), that I am interested in generative AI, and working out.

Another day might have yielded far more interesting facts, but those bits added to a record of my interests and habits can become quite powerful over time.

Re: Governments spying on Apple, Google users through push notifications

#12

Post by 2OEH8eoCRo0 »

> In a statement, Apple said that Wyden's letter gave them the opening they needed to share more details with the public about how governments monitored push notifications.

> "In this case, the federal government prohibited us from sharing any information," the company said in a statement. "Now that this method has become public we are updating our transparency reporting to detail these kinds of requests."

If Apple knew about this why wouldn't they limit their exposure to this user data?

Re: Governments spying on Apple, Google users through push notifications

#13

Post by popcalc »

jruohonen wrote: post #9
Ensorceled wrote: post #7

Earlier quoted context omitted.

I see that there is a lot of signal coming over my push notifications ... how would using this signal make spies incompetent?

> I see that there is a lot of signal What signals are you talking about? Someone tends to respond to Tinder's notifications at 6 PM on weekends, and such useless data?

It would indicate that they're lonely and looking for a partner. If you were looking to turn them into an intelligence asset, you could have an officer approach and seduce them.

If it's Grindr instead of Tinder, or if they're married, you have a blackmailing angle. In a lot of countries it would be very effective.

Re: Governments spying on Apple, Google users through push notifications

#14

Post by bryancoxwell »

matthewdgreen wrote: post #8

Some issues could be prevented if push messages added end-to-end encryption by default, something that shouldn’t be particularly hard to use if it was built into the dev tooling. Instead, developer recommendations like this one [0] suggest that you should put content into your push messages and optionally use a separate library to encrypt them. Clearly developers aren’t doing this, hence the opportunity for surveilla…

If it’s metadata they’re after (according to the article) would it really matter if the push notifications themselves were encrypted? As long as you’re using Apple/Google’s servers to manage push notifications it seems like there would be some metadata that could be useful for surveillance purposes, encrypted or not.

Re: Governments spying on Apple, Google users through push notifications

#15

Post by catchnear4321 »

> …a source familiar with the matter confirmed that both foreign and U.S. government agencies have been asking Apple and Google for metadata related to push notifications to, for example, help tie anonymous users of messaging apps to specific Apple or Google accounts.

Re: Governments spying on Apple, Google users through push notifications

#18

Post by jruohonen »

bmelton wrote: post #11
jruohonen wrote: post #2

[flagged]

In what way would ignoring a viable SIGINT source be incompetent? Just thinking about only my push notifications yesterday and they revealed that I am clearly a developer or technologist (push notifications from Git/AWS/etc), who got a haircut (time and location were revealed in the message, but I'm sure government-level agencies could have tracked which SportClips location the appointment belonged to), that I am int…

> Just thinking about only my push notifications yesterday

See, the gist in the letter is this sentence:

"As with all of the other information these companies store for or about their users, because Apple and Google deliver push notification data, they can be secretly compelled by governments to hand over this information."

Do you really think that a foreign government is interested in push notifications when issuing a demand to disclose data from a phone?

Re: Governments spying on Apple, Google users through push notifications

#19

Post by ImPostingOnHN »

jruohonen wrote: post #9
Ensorceled wrote: post #7

Earlier quoted context omitted.

I see that there is a lot of signal coming over my push notifications ... how would using this signal make spies incompetent?

> I see that there is a lot of signal What signals are you talking about? Someone tends to respond to Tinder's notifications at 6 PM on weekends, and such useless data?

Suppose you use an anonymous app for messaging. The government sees the conversation ("good day to you") but doesn't know who is on one side (perhaps both).

So they ask Apple "who exactly sent or received on their phone a push notification for 'good day to you'?" Or perhaps "who sent or received push notifications from secure messaging app around 8:24:39.124 pm, 8:26:12.322, etc.?"

Apple tells them, and now they know the identity of the "anonymous" recipient. Replace "good day to you" with any text disliked by any format or current or future government.

Post reply on HN