Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Governments spying on Apple, Google users through push notifications

reuters.com

Post reply on HN
Print view View original

101–110 of 649 posts

Re: Governments spying on Apple, Google users through push notifications

#101

Post by acdha »

HumblyTossed wrote: post #80
MaxikCZ wrote: post #76

Earlier quoted context omitted.

I so hate when people put words "only" and "metadata" in the same sentence... They know you rang a phone sex line at 2:24 am and spoke for 18 minutes. But they don't know what you talked about. They know you called the suicide prevention hotline from the Golden Gate Bridge. But the topic of the call remains a secret. They know you got an email from an HIV testing service, then called your doctor, then visited an HIV…

Dude, did you read my point? I said it was still bad.

I don’t agree with them plagiarizing the EFF’s blog post[0] but I think it is a mistake to use “only”. Both can be damaging and neither is clearly more or less bad since so much depends on the circumstances – like if the police have compromised one party in a conversation, they already have the payload so the real risk would be things like location data. We should probably treat both of those as equivalent risks until enough specific details about a situation are available to say which is riskier.

0. https://ssd.eff.org/module/communicating-others

Re: Governments spying on Apple, Google users through push notifications

#102

Post by HumblyTossed »

acdha wrote: post #101
HumblyTossed wrote: post #80

Earlier quoted context omitted.

Dude, did you read my point? I said it was still bad.

I don’t agree with them plagiarizing the EFF’s blog post[0] but I think it is a mistake to use “only”. Both can be damaging and neither is clearly more or less bad since so much depends on the circumstances – like if the police have compromised one party in a conversation, they already have the payload so the real risk would be things like location data. We should probably treat both of those as equivalent risks unti…

But my intention was to point out that actual content wasn't being transmitted and that "only" meta data was gleaned since some people seem to think that chat messages are being scooped up. Other people have rightly pointed out that meta data is bad and why and I didn't feel the need to reiterate that.

Re: Governments spying on Apple, Google users through push notifications

#103

Post by wahnfrieden »

pcrh wrote: post #74
kamikazeturtles wrote: post #30

Earlier quoted context omitted.

It already in exists in the form of Anti-BDS laws. 35 states already have them

>Anti-BDS laws These would seem to contravene the First Amendment.

And? The US doesn’t work the way you think it does. It operates illegally and protects its powers over people. As a factual observation. What then

Re: Governments spying on Apple, Google users through push notifications

#104

Post by acdha »

Zak wrote: post #21

It's a huge problem for both privacy and the open source ecosystem that Apple and Google mandate use of their own notification system for apps to be included in their stores.

There were huge downsides for battery life before, and privacy is somewhat orthogonal since you’d be at risk from more companies and they’d all be subject to the same legal demands, so I think the answer has to be regulatory. In the EU, that seems possible but I’m not sure the U.S. government is currently functional enough to do anything about this.

Re: Governments spying on Apple, Google users through push notifications

#105

Post by Terretta »

andsoitis wrote: post #91
omginternets wrote: post #31

I noted that Apple says the governments in question are allies of the United States. I wonder if this is a case of American intelligence outsourcing the surveillance of American citizens to foreign intelligence. If that is indeed the case, I’d expect a quid pro quo.

> I wonder if this is a case of American intelligence outsourcing the surveillance of American citizens to foreign intelligence. If that is indeed the case, I’d expect a quid pro quo. Yet it is the US government who revealed it: "In a letter to the Department of Justice, Senator Ron Wyden said foreign officials were demanding the data from Alphabet's (GOOGL.O) Google and Apple (AAPL.O). Although details were sparse,…

> Yet it is the US government who revealed it

Less "the government" and more "a member of government", the same member who has revealed and demanded accountability when discovering domestic government overreach.

We should choose our congress critters carefully.

Re: Governments spying on Apple, Google users through push notifications

#106

Post by AndrewKemendo »

This is yet another example of: If the data can be collected it will be used by governments

You can slow this down by making data explicitly built to be impossible to read in transit (eg e2e) and then deleting or never saving it, but the fact that data flows through multiple stops means each transition is an opportunity for third party observation

This is deterministic and is built into the structure of data production transport and consumption. This is part of the infrastructure and cannot be extricated

Re: Governments spying on Apple, Google users through push notifications

#107

Post by acdha »

keepamovin wrote: post #70
notaustinpowers wrote: post #34

What sort of metadata or information can be gathered from a push notification from an app like iMessage? I know a timestamp is there and most likely the sender's phone number. But is there some sort of sensitive info that these governments are trying to glean? Or is it more so they can build info maps and communication maps on targets?

If you were able to do this, and you also had control of the person's ISP/cell network (not unusual for the threat model here), then one thing you could do is interfere with their communications, "shadowbanning" them from their friends/contacts. Say you used a particular app, like LINE, to speak to one particular friend who your "benefactors" didn't want you speaking with, they could drop connections between your dev…

This would only work if the protocol doesn’t have the concept of retries, which it does. They’d have to block all communications which would be highly noticeable - especially since you’d get a flurry of messages any time you opened the app or migrated onto a Wi-Fi network.

Re: Governments spying on Apple, Google users through push notifications

#108

Post by Spivak »

MaxikCZ wrote: post #76
HumblyTossed wrote: post #65

It should only[0] be meta data, though. The push notification should signal the app that there is data to fetch, then the app goes and fetches it. The push notification itself should carry none of the data. [0] still bad though and they should stop.

I so hate when people put words "only" and "metadata" in the same sentence... They know you rang a phone sex line at 2:24 am and spoke for 18 minutes. But they don't know what you talked about. They know you called the suicide prevention hotline from the Golden Gate Bridge. But the topic of the call remains a secret. They know you got an email from an HIV testing service, then called your doctor, then visited an HIV…

Push notifications don't signal an active line of communication like that though nor do they connect who's talking, only the means. In all your examples the equivalent would be "They know someone called you."

"They know you got a push from McDonalds at 11am"

"They know you got a Slack message at 2pm"

All metadata is not created equal.

Re: Governments spying on Apple, Google users through push notifications

#109

Post by 2OEH8eoCRo0 »

MaxikCZ wrote: post #76
HumblyTossed wrote: post #65

It should only[0] be meta data, though. The push notification should signal the app that there is data to fetch, then the app goes and fetches it. The push notification itself should carry none of the data. [0] still bad though and they should stop.

I so hate when people put words "only" and "metadata" in the same sentence... They know you rang a phone sex line at 2:24 am and spoke for 18 minutes. But they don't know what you talked about. They know you called the suicide prevention hotline from the Golden Gate Bridge. But the topic of the call remains a secret. They know you got an email from an HIV testing service, then called your doctor, then visited an HIV…

It's important but what do we do about it?

You're using the internet afterall which isn't your network- it's someone else's! When you send a packet there is a header w/ information required for routing. Some call this the "outside of the envelope" if using the mail analogy. We can pass the buck by using a VPN but this also adds a VPN org that we need to trust. On the other hand, it's not your network! Why do you think you have a right to absolute secrecy and anonymity on someone else's network?

Re: Governments spying on Apple, Google users through push notifications

#110

Post by matthewdgreen »

bryancoxwell wrote: post #14
matthewdgreen wrote: post #8

Some issues could be prevented if push messages added end-to-end encryption by default, something that shouldn’t be particularly hard to use if it was built into the dev tooling. Instead, developer recommendations like this one [0] suggest that you should put content into your push messages and optionally use a separate library to encrypt them. Clearly developers aren’t doing this, hence the opportunity for surveilla…

If it’s metadata they’re after (according to the article) would it really matter if the push notifications themselves were encrypted? As long as you’re using Apple/Google’s servers to manage push notifications it seems like there would be some metadata that could be useful for surveillance purposes, encrypted or not.

Getting rid of all metadata is fundamentally hard, unless providers are willing to deploy PIR or anonymity networks. But I think it's a mistake to assume metadata means "just the timing of a message": these push messages may include a lot of detailed content that is being described in this article as metadata, and all of that stuff can and should be encrypted.

Additionally, with a little bit of work (well, really quite a lot) the push messages can be made to hide the source. This would make it harder to distinguish a Gmail or DoorDash notification from a WhatsApp notification.

Post reply on HN