Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Governments spying on Apple, Google users through push notifications

reuters.com

Post reply on HN
Print view View original

91–100 of 649 posts

Re: Governments spying on Apple, Google users through push notifications

#91

Post by andsoitis »

omginternets wrote: post #31

I noted that Apple says the governments in question are allies of the United States. I wonder if this is a case of American intelligence outsourcing the surveillance of American citizens to foreign intelligence. If that is indeed the case, I’d expect a quid pro quo.

> I wonder if this is a case of American intelligence outsourcing the surveillance of American citizens to foreign intelligence. If that is indeed the case, I’d expect a quid pro quo.

Yet it is the US government who revealed it: "In a letter to the Department of Justice, Senator Ron Wyden said foreign officials were demanding the data from Alphabet's (GOOGL.O) Google and Apple (AAPL.O). Although details were sparse, the letter lays out yet another path by which governments can track smartphones." - https://www.reuters.com/technology/cybersecurity/governments...

Re: Governments spying on Apple, Google users through push notifications

#92

Post by acdha »

nvahalik wrote: post #28

Are the contents of push notifications not encrypted? Or are we talking about payloads rather than transport?

Others have mentioned the timing attacks but also payloads are not encrypted unless the app developers remember to build that. This linked essay discusses both threats:

https://blog.davidlibeau.fr/push-notifications-are-a-privacy...

Re: Governments spying on Apple, Google users through push notifications

#93

Post by GoblinSlayer »

garblegarble wrote: post #40
matthewdgreen wrote: post #8

Some issues could be prevented if push messages added end-to-end encryption by default, something that shouldn’t be particularly hard to use if it was built into the dev tooling. Instead, developer recommendations like this one [0] suggest that you should put content into your push messages and optionally use a separate library to encrypt them. Clearly developers aren’t doing this, hence the opportunity for surveilla…

The timing would still give you away - with a privileged network position you can tell that a user sent a message to an messaging service, and that some set of users got notifications from that messaging service moments later. Observe that enough times and you'll have good confidence in the members of a group. If you're trying to hide from that type of attack you need to send a fixed rate stream of messages (most of…

If notification is malformed or erroneous it should be invisible, shouldn't it?

Re: Governments spying on Apple, Google users through push notifications

#95

Post by ericmay »

thallium205 wrote: post #77
peterkelly wrote: post #56

Earlier quoted context omitted.

Australia was my first guess when I read that sentence. But I expect it's not the only one.

It’s likely the five eyes allied nations.

Yep. Most likely to try and catch Chinese spies or other countries like India, Iran, Russia, and others as they continue to go after dissidents abroad.

Re: Governments spying on Apple, Google users through push notifications

#96

Post by eggy »

Given a lot of journalists and activists use encrypted communications to be able to do their job without being unduly or unjustly persecuted (yes, the bad guys use them too!), and 12 US State Attorney Generals just signed a letter and delivered it to the major news agencies (NYT, CNN, Reuters, AP, etc.) that warns of any "support to terrorist organizations" and specifically points out Hamas, but is not very clear on what "support" or "business relationship" means (sending a camera to do a report where the press is not allowed due to Israel's complete control of the media - echoes of US journalist access during the Iraq War), and puts them on notice. Nothing is safe from Big Brother, anywhere, any country.

Re: Governments spying on Apple, Google users through push notifications

#97

Post by kyrra »

ta988 wrote: post #49
Zak wrote: post #21

It's a huge problem for both privacy and the open source ecosystem that Apple and Google mandate use of their own notification system for apps to be included in their stores.

And now we understand why they do that.

It is driven entirely by battery life. Android used to allow 3rd party apps to receive push notifications, and it caused battery life to be terrible compared to Apple. Forcing a single path was done for that reason.

Btw, here's the telegram team complaining about the change: https://github.com/Telegram-FOSS-Team/Telegram-FOSS/blob/mas...

Facebook abused this a bunch. https://www.theguardian.com/technology/2016/feb/01/uninstall...

Re: Governments spying on Apple, Google users through push notifications

#98

Post by rchaud »

JustLurking2022 wrote: post #67
Eumenes wrote: post #23

Earlier quoted context omitted.

Yeah he's awesome. /s In May 2017, Wyden co-sponsored the Israel Anti-Boycott Act, Senate Bill 720, which made it a federal crime, punishable by a maximum sentence of 20 years imprisonment,[88] for Americans to encourage or participate in boycotts against Israel and Israeli settlements in the occupied Palestinian territories if protesting actions by the Israeli government. The bill would make it legal for U.S. states…

That sounds like an attempt to ban political expression that is certainly protected by the First Amendment.

Wyden knows such a bill wouldn't pass specifically because of its unconstitutionality. This was about picking up media coverage by throwing red meat at voters.

Congress has been in a state of deadlock for too long to pass any actual laws, so this type of performative theater ahead of midterm elections is what passes for statesmanship.

Re: Governments spying on Apple, Google users through push notifications

#99

Post by HumblyTossed »

fsflover wrote: post #87
HumblyTossed wrote: post #80

Earlier quoted context omitted.

Dude, did you read my point? I said it was still bad.

"Still bad" strongly underestimates the problem. Metadata often is more important than the data as demonstrated in the above examples.

But my intention was to point out that actual content wasn't being transmitted and that "only" meta data was gleaned since some people seem to think that chat messages are being scooped up. Other people have rightly pointed out that meta data is bad and why and I didn't feel the need to reiterate that.

Re: Governments spying on Apple, Google users through push notifications

#100

Post by multiplegeorges »

notaustinpowers wrote: post #34

What sort of metadata or information can be gathered from a push notification from an app like iMessage? I know a timestamp is there and most likely the sender's phone number. But is there some sort of sensitive info that these governments are trying to glean? Or is it more so they can build info maps and communication maps on targets?

Compromise a single phone in a target group, send a message to an anonymous chat, and you now know every other member of the group.

Apple needs to know your Apple ID to send you an APNS payload. Now your anonymous chat profile is tied to your real Apple ID. Busted.

Post reply on HN