Live data from Hacker News

Governments spying on Apple, Google users through push notifications

reuters.com

131–140 of 649 posts

Re: Governments spying on Apple, Google users through push notifications

#131

Earlier quoted context omitted.

I disagree. Thieves can't steal my money from my bank with metadata.

They might, using social engineering and knowing a lot about your connections.

That's a stretch, you can use social engineering to do essentially anything then.

Re: Governments spying on Apple, Google users through push notifications

#133

This, to me, is the more disturbing part of the article: > In this case, the federal government prohibited us from sharing any information," the company said in a statement. "Now that this method has become public we are updating our transparency reporting to detail these kinds of requests. What is the point of transparency reports if they don't include major vectors of government surveillance? IMO such gag orders sh…

> What is the point of transparency reports if they don't include major vectors of government surveillance?

How many times did those of us who knew all of this to be a farce warned about this?

Re: Governments spying on Apple, Google users through push notifications

#134
post #104
post #21

It's a huge problem for both privacy and the open source ecosystem that Apple and Google mandate use of their own notification system for apps to be included in their stores.

There were huge downsides for battery life before, and privacy is somewhat orthogonal since you’d be at risk from more companies and they’d all be subject to the same legal demands, so I think the answer has to be regulatory. In the EU, that seems possible but I’m not sure the U.S. government is currently functional enough to do anything about this.

Allowing third-party notification systems (such as UnifiedPush) would have practically no negative effect on battery life

Not to mention that people might prefer to use some more battery in exchange for more privacy

Re: Governments spying on Apple, Google users through push notifications

#136
post #113

Earlier quoted context omitted.

There's no need for notification snooping when these apps are spamming requests to unique subdomains on analytics services and their own APIs. DNS snooping is a much easier method of getting that metadata. Although I suppose one advantage of push notifications compared to DNS is that they're delivered even when the app isn't open, and more generally they can also serve as a liveness check (successful delivery means y…

Just because some apps use insecure but highly identifiable DNS lookups doesn’t mean everyone does, or that DNS-over-HTTPS will never be deployed (iOS shipped support in 2020 and Android was only a couple of years later). There’s a 0% chance that anyone smart would say they should rely on that alone and not develop other sources for that information, and intelligence agencies have hired many smart technical people.

In general, I agree DNS-over-HTTPS is a step in the right direction, in terms of eliminating the low-hanging fruit of snooping over the wire. But it's still the same major companies providing the resolvers. And if you're sending them an NSL for push notifications, you may as well send one for DNS too.

Re: Governments spying on Apple, Google users through push notifications

#137
post #23

Earlier quoted context omitted.

Yeah he's awesome. /s In May 2017, Wyden co-sponsored the Israel Anti-Boycott Act, Senate Bill 720, which made it a federal crime, punishable by a maximum sentence of 20 years imprisonment,[88] for Americans to encourage or participate in boycotts against Israel and Israeli settlements in the occupied Palestinian territories if protesting actions by the Israeli government. The bill would make it legal for U.S. states…

Well it's pretty unlikely such a law would stand up in any court even small claim's court

Uh it's already the law in dozens of states. The Arkansas law was challenged, but upheld by the appeals court and SCOTUS refused to hear the case.

Re: Governments spying on Apple, Google users through push notifications

#138

This, to me, is the more disturbing part of the article: > In this case, the federal government prohibited us from sharing any information," the company said in a statement. "Now that this method has become public we are updating our transparency reporting to detail these kinds of requests. What is the point of transparency reports if they don't include major vectors of government surveillance? IMO such gag orders sh…

perhaps that democracy is not effective when the state organs are unelected bureacrats with guns

I'm not sure why you're being downvoted. That's been a common charge against our vast unelected bureaucracy, most of whom hold qualified immunity. We're trillions of dollars in debt, maybe it's time to peel some of it back a little.

Re: Governments spying on Apple, Google users through push notifications

#139

Earlier quoted context omitted.

They might, using social engineering and knowing a lot about your connections.

That's a stretch, you can use social engineering to do essentially anything then.

Not if you know nothing about your target.
Post reply on HN