Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Governments spying on Apple, Google users through push notifications

reuters.com

Post reply on HN
Print view View original

291–300 of 649 posts

Re: Governments spying on Apple, Google users through push notifications

#291

Post by keepamovin »

acdha wrote: post #107
keepamovin wrote: post #70

Earlier quoted context omitted.

If you were able to do this, and you also had control of the person's ISP/cell network (not unusual for the threat model here), then one thing you could do is interfere with their communications, "shadowbanning" them from their friends/contacts. Say you used a particular app, like LINE, to speak to one particular friend who your "benefactors" didn't want you speaking with, they could drop connections between your dev…

This would only work if the protocol doesn’t have the concept of retries, which it does. They’d have to block all communications which would be highly noticeable - especially since you’d get a flurry of messages any time you opened the app or migrated onto a Wi-Fi network.

I suppose it depends on which protocol, and which app, we're talking about, but...Interesting. Good analysis!

It's conceivable that connectivity checks flow to other servers than delivery traffic, and these are passed-through. Although addressing your more general critique of the "flurry" (good word! :)), requires noting that accomplishing this capability would involve compromising the app's servers. Such backdoors are again not outside the realm of possibility in the given threat model.

Do you see any possibilities for interference in the push interception capability described?

Re: Governments spying on Apple, Google users through push notifications

#293

Post by g-b-r »

I_Am_Nous wrote: post #244
g-b-r wrote: post #125

Earlier quoted context omitted.

So every person in the world should build his own "network"?

No, it's just a case of facing reality. The internet is built by other people and we have to trust (or not) that they are going to honor the responsibility that entails, from security to ethics. The internet is also funded by learning as much as possible about users in general so using the internet is accepting that you will be tracked. Increasing personal security is good, but no silver bullet.

If with that you mean that users should be aware of the risks ok, if that they should accept them as inevitable no.

What's funded by tracking as much as possible is the current perverse part of internet, it definitely wasn't always like that and doesn't need to be.

I hope that that perspective comes from someone that hasn't lived anything before Facebook.

Re: Governments spying on Apple, Google users through push notifications

#294

Post by jeroenhd »

heywoodlh wrote: post #262

One question I have as someone who tries to maintain (some) data sovereignty: is there any way as an end-user to circumvent/mitigate this kind of surveillance — aside from abandoning iOS and Android completely?

Google-free Android will allow you (force you) to use alternative push servers. That could be your own server (using something like Unified Push) or querying your apps' servers directly. This comes at the cost of battery life, sometimes significantly so, but it does decentralise the notification system.

Of course, your data will still be in the hands of app vendors unless you choose your apps wisely.

You should also block analytics on the network level (using firewall apps or alternative means) because these days developers like to send analytics events for every button pressed, all associated with your phone's unique identifier. If the government can use push notifications for tracking, imagine the tracking they can do through Firebase Analytics or one of its many data hoarding alternatives.

Re: Governments spying on Apple, Google users through push notifications

#295

Post by CharlesW »

sneak wrote: post #271
heywoodlh wrote: post #262

One question I have as someone who tries to maintain (some) data sovereignty: is there any way as an end-user to circumvent/mitigate this kind of surveillance — aside from abandoning iOS and Android completely?

On iOS, all notifications must go via the centralized APNS, but on non-Google Android (eg Graphene) it is possible to run the device with the Google FCM stuff blocked off. Some apps will break, but stuff that runs in the background for polling or does non-Google notifications will continue to work.

The Reuters article says that the government is getting this data from Apple and Google, which means it doesn't matter if your phone displays or even receives the notifications, no?

Re: Governments spying on Apple, Google users through push notifications

#296

Post by fsflover »

loughnane wrote: post #284

I know Pinephone isn't ready for daily use from all the threads here, but I just ordered one to get some stick time with it. Getting real tired of having to fight my phone to keep my data mine. I just want the equivalent of debian, but on mobile. I understand I'll have to give up a bunch of apps, but honestly I think its worth it. As soon as its possible I'd like off this ride.

Alternatively, consider Librem 5, which is more stable, since its software is developed by a dedicated team.

Re: Governments spying on Apple, Google users through push notifications

#297

Post by Clubber »

JohnFen wrote: post #250
Clubber wrote: post #230

Earlier quoted context omitted.

And if the agencies go outside the bounds of those laws like some currently do?

Then those who are victimized take it to court. If the agency committed an actual crime, then there's a path for that to be prosecuted as well. It's certainly not a perfect system, but it's successfully done all the time.

>> The only teeth congress has with these bureaucracies is the power of the purse.

>Not true. Congress can make laws defining what those agencies are and are not allowed to do.

>And if the agencies go outside the bounds of those laws like some currently do?

>Then those who are victimized take it to court.

Right, the court isn't congress. My point was the only teeth congress has in regards to the bureaucracies is the power of the purse.

>successfully done all the time.

It depends on how you define successfully. I mean they employ people, is that good enough? Do you think they would be more or less effective with a 20% haircut? I don't really know, but members congress probably don't either. Plus, it's bad politics to cut jobs come election time, right? Seems like a perverse incentive for the people charged overseeing the bureaucracies.

Re: Governments spying on Apple, Google users through push notifications

#298

Post by yonatan8070 »

loughnane wrote: post #284

I know Pinephone isn't ready for daily use from all the threads here, but I just ordered one to get some stick time with it. Getting real tired of having to fight my phone to keep my data mine. I just want the equivalent of debian, but on mobile. I understand I'll have to give up a bunch of apps, but honestly I think its worth it. As soon as its possible I'd like off this ride.

Does Waydroid work well on mobile Linux GUIs like Phosh and Plasma Mobile? If it does it could be real handy to sandbox some Android apps you need for work or whatever while still using a proper Linux base

Re: Governments spying on Apple, Google users through push notifications

#300

Post by hindsightbias »

gowld wrote: post #172

It's fascinating that about half hese comments appear to be from younger people unfamiliar with "USA PATRIOT" Act gag orders, FISA, Five Eyes, Least Untruthful Response and related controversies that were big in the news 10-20 years ago. Amusingly and sadly, the law was called PATRIOT as a normal "give a bad law a Good name", but over time "patriot" has become synonym for "traitor" in common use.

Why would it be unusual for a generation that’s been under surveillance since they were in the incubator to not hold quaint and obsolete views of privacy?

If we held a poll, what percentage of privacy-loving HN parents don’t have tracking on their kids phone? 5%? 10%?

Post reply on HN