Live data from Hacker News

Governments spying on Apple, Google users through push notifications

reuters.com

121–130 of 649 posts

Re: Governments spying on Apple, Google users through push notifications

#121

Earlier quoted context omitted.

> I wonder if this is a case of American intelligence outsourcing the surveillance of American citizens to foreign intelligence. If that is indeed the case, I’d expect a quid pro quo. Yet it is the US government who revealed it: "In a letter to the Department of Justice, Senator Ron Wyden said foreign officials were demanding the data from Alphabet's (GOOGL.O) Google and Apple (AAPL.O). Although details were sparse,…

> Yet it is the US government who revealed it Less "the government" and more "a member of government", the same member who has revealed and demanded accountability when discovering domestic government overreach. We should choose our congress critters carefully.

Congress has so little power its becoming a vestigial organ. Only there to placate the masses who believe their vote makes any impact.

Re: Governments spying on Apple, Google users through push notifications

#122
post #21

It's a huge problem for both privacy and the open source ecosystem that Apple and Google mandate use of their own notification system for apps to be included in their stores.

I use Telegram FOSS. They refuse to use firebase for notifications, so I forever have a message in my drawer that leads to this link:

https://github.com/Telegram-FOSS-Team/Telegram-FOSS/blob/mas...

I doubt it solves much but I like to think of it as a little poke in the eye.

Re: Governments spying on Apple, Google users through push notifications

#123

This, to me, is the more disturbing part of the article: > In this case, the federal government prohibited us from sharing any information," the company said in a statement. "Now that this method has become public we are updating our transparency reporting to detail these kinds of requests. What is the point of transparency reports if they don't include major vectors of government surveillance? IMO such gag orders sh…

Seems like a pretty open and shut case of unconstitutional restriction of speech in the US. Especially when you consider the wording of the Apple communication saying that they can talk about it openly now that it's public knowledge.

How exactly do you bring suit on this matter?

Hey we would like to bring suit because the government says we can't talk about them doing X. Oh no, that would be talking about doing X!!

Re: Governments spying on Apple, Google users through push notifications

#124

This, to me, is the more disturbing part of the article: > In this case, the federal government prohibited us from sharing any information," the company said in a statement. "Now that this method has become public we are updating our transparency reporting to detail these kinds of requests. What is the point of transparency reports if they don't include major vectors of government surveillance? IMO such gag orders sh…

>What is the point of transparency reports if they don't include major vectors of government surveillance?

The feels.

Re: Governments spying on Apple, Google users through push notifications

#125
post #76

Earlier quoted context omitted.

I so hate when people put words "only" and "metadata" in the same sentence... They know you rang a phone sex line at 2:24 am and spoke for 18 minutes. But they don't know what you talked about. They know you called the suicide prevention hotline from the Golden Gate Bridge. But the topic of the call remains a secret. They know you got an email from an HIV testing service, then called your doctor, then visited an HIV…

It's important but what do we do about it? You're using the internet afterall which isn't your network- it's someone else's! When you send a packet there is a header w/ information required for routing. Some call this the "outside of the envelope" if using the mail analogy. We can pass the buck by using a VPN but this also adds a VPN org that we need to trust. On the other hand, it's not your network! Why do you thin…

So every person in the world should build his own "network"?

Re: Governments spying on Apple, Google users through push notifications

#127

Earlier quoted context omitted.

It would very much help if you wanted to stop the government hoovering up the content of chat messages sent as push notifications

Encrypted messengers aren’t sending unencrypted push payloads, at least not deliberately. A lot of apps don’t even put much in the push messages themselves at all, they are mainly an indicator to phone home for more information. Consequently no gov has been getting meaningful info from the content of this stuff for many years - it will all be what you can infer from observed patterns, which is a lot.

I'm not sure I'd trust dating apps and weaker chat apps not to just be sending the contents of messages to a TLS push notification endpoint that Apple/Google could do whatever with before forwarding on to devices.

Re: Governments spying on Apple, Google users through push notifications

#128

Earlier quoted context omitted.

"Still bad" strongly underestimates the problem. Metadata often is more important than the data as demonstrated in the above examples.

I disagree. Thieves can't steal my money from my bank with metadata.

They might, using social engineering and knowing a lot about your connections.

Re: Governments spying on Apple, Google users through push notifications

#129

Earlier quoted context omitted.

> I wonder if this is a case of American intelligence outsourcing the surveillance of American citizens to foreign intelligence. If that is indeed the case, I’d expect a quid pro quo. Yet it is the US government who revealed it: "In a letter to the Department of Justice, Senator Ron Wyden said foreign officials were demanding the data from Alphabet's (GOOGL.O) Google and Apple (AAPL.O). Although details were sparse,…

> Yet it is the US government who revealed it Less "the government" and more "a member of government", the same member who has revealed and demanded accountability when discovering domestic government overreach. We should choose our congress critters carefully.

>We should choose our congress critters carefully.

Agreed 100% and sadly, quite rare. I'm not going to start naming names, because that would devolve this into a political conversation about the parties. That isn't this. I suspect most people know who the criminals are. Now to see if they care.

Re: Governments spying on Apple, Google users through push notifications

#130

Earlier quoted context omitted.

The timing would still give you away - with a privileged network position you can tell that a user sent a message to an messaging service, and that some set of users got notifications from that messaging service moments later. Observe that enough times and you'll have good confidence in the members of a group. If you're trying to hide from that type of attack you need to send a fixed rate stream of messages (most of…

If notification is malformed or erroneous it should be invisible, shouldn't it?

I think (reading between the lines on their docs) that you'll get throttled/dropped if you abuse the system by sending a regular push notification but do not notify the user. Apple doesn't like app developers using invisible notifications because it risks wasting device battery without the users being aware that their device is constantly being awakened by your app.

However, I was actually wrong more generally because Apple does have push notification type for this, Background Updates[1] are permitted to run invisibly. They say not to try sending more than 2-3 per hour, and that "the system may throttle the delivery of background notifications if the total number becomes excessive" - which sounds like you're permitted some unspecified small number between app launches.

These notifications seem to only be able to send a single boolean flag, so it doesn't seem like an awfully viable way of implementing a fixed rate message system (especially because you'd also want to be sending messages out on that same fixed rate to frustrate analysis)

1: https://developer.apple.com/documentation/usernotifications/...

Post reply on HN