Pardon my ignorance but would block all push notifications stop this specific act of surveillance? I usually don't need any notifications' content on the screen apart from "you have a new message on , go check it". Or is that what's being discussed here?
Governments spying on Apple, Google users through push notifications
61–70 of 649 posts
Re: Governments spying on Apple, Google users through push notifications
#62Ron Ryden has been barking up this tree for a long time:
https://www.wyden.senate.gov/issues/secret-law
https://www.wyden.senate.gov/news/press-releases/wyden-colle...
https://www.wyden.senate.gov/news/press-releases/wyden-intro...
https://www.wyden.senate.gov/priorities/gps-act
https://www.wyden.senate.gov/news/press-releases/wyden-relea...
Re: Governments spying on Apple, Google users through push notifications
#63Metadata in this case apparently means Apple and Google are helping find “this real user connected to that real user at this time”. So governments may or may not be able to decrypt a push message payload, or data delivered because of that payload.
An interesting point in Glenn Greenwald’s book is that metadata is often more informative than the “real” data.
Consider:
1. A phone call in which Mrs. Smith talks to a receptionist to set an appointment with a doctor for 9:30 next Wednesday.
Vs.
2. Knowing that Mrs. Smith called an abortion clinic.
#2 seems like a bigger violation of privacy. Metadata is the real data.
Re: Governments spying on Apple, Google users through push notifications
#64Earlier quoted context omitted.
Encryption wouldn’t help as the whole point would be to look for coincident timings. I.e. after activity from one user to a known service you see a push occur going to another user. If this pattern repeats you can build confidence they are in contact.
It would very much help if you wanted to stop the government hoovering up the content of chat messages sent as push notifications
Encrypted messengers aren’t sending unencrypted push payloads, at least not deliberately.
A lot of apps don’t even put much in the push messages themselves at all, they are mainly an indicator to phone home for more information.
Consequently no gov has been getting meaningful info from the content of this stuff for many years - it will all be what you can infer from observed patterns, which is a lot.
Re: Governments spying on Apple, Google users through push notifications
#65It should only[0] be meta data, though. The push notification should signal the app that there is data to fetch, then the app goes and fetches it. The push notification itself should carry none of the data.
[0] still bad though and they should stop.
Re: Governments spying on Apple, Google users through push notifications
#66Related: https://news.ycombinator.com/item?id=38543587
Apple Confirms Governments Using Push Notifications to Surveil Users (macrumors.com)
Re: Governments spying on Apple, Google users through push notifications
#67Hey other states, can you elect a few more Ron Wydens? He's been doing a ton of the heavy lifting lately. Every time we hear about the intelligence community egregiously violating civil liberties, it's always Wyden.
Yeah he's awesome. /s In May 2017, Wyden co-sponsored the Israel Anti-Boycott Act, Senate Bill 720, which made it a federal crime, punishable by a maximum sentence of 20 years imprisonment,[88] for Americans to encourage or participate in boycotts against Israel and Israeli settlements in the occupied Palestinian territories if protesting actions by the Israeli government. The bill would make it legal for U.S. states…
That sounds like an attempt to ban political expression that is certainly protected by the First Amendment.
Re: Governments spying on Apple, Google users through push notifications
#68Pardon my ignorance but would block all push notifications stop this specific act of surveillance? I usually don't need any notifications' content on the screen apart from "you have a new message on , go check it". Or is that what's being discussed here?
The article says that Google and Apple know about the push notifications being shown on the phone and governments can make these companies turn over customer data.
I'm not sure if it only covers (for example) the unified notification service on Android or whether Apple and Google know of notifications that don't make use of that API. It's not clear from the article.
Re: Governments spying on Apple, Google users through push notifications
#69Is anyone surprised? Why would there be pen registers, and tap and trace for phone calls and email, but not for other traffic? The ability of governments to do secret surveillance of such metadata is well established in law and jurisprudence, variously in various countries.
It is a Weird Nerd Thing to believe that old laws can't apply to new computer thing.
Re: Governments spying on Apple, Google users through push notifications
#70What sort of metadata or information can be gathered from a push notification from an app like iMessage? I know a timestamp is there and most likely the sender's phone number. But is there some sort of sensitive info that these governments are trying to glean? Or is it more so they can build info maps and communication maps on targets?
If you were able to do this, and you also had control of the person's ISP/cell network (not unusual for the threat model here), then one thing you could do is interfere with their communications, "shadowbanning" them from their friends/contacts. Say you used a particular app, like LINE, to speak to one particular friend who your "benefactors" didn't want you speaking with, they could drop connections between your device and that app's servers whenever they intercept a push notification from Google or Apple targeted to that app on your device. Effectively preventing the two parties ever communicating.
Depending on specifics, it seems it would be possible to do this cleverly, so the app still thinks it's connected, but just never receives these messages.
I'm not an expert on this, it just seems a plausible possibility. Best effort response to your question! :)