Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Governments spying on Apple, Google users through push notifications

reuters.com

Post reply on HN
Print view View original

341–350 of 649 posts

Re: Governments spying on Apple, Google users through push notifications

#341

Post by Klonoar »

angio wrote: post #32
nvahalik wrote: post #28

Are the contents of push notifications not encrypted? Or are we talking about payloads rather than transport?

They mention metadata in the article. Imagine sending a message to a Signal account at time X, then asking Apple a list of all users that received a Signal notification at that specific time.

Unless I’m mistaken - and I might be or it may have changed - Signal notifications on iOS just tell the app “hey, something happened, call the service and check for updates”.

I.e, the push notification itself contains little to nothing in terms of data/metadata.

You can also of course decrypt a notification by shipping an extension to do so, and maybe Signal does - it’s been awhile since I poked around it. I’d just be surprised if the Signal team didn’t analyze the issue to death and find the gaps.

Re: Governments spying on Apple, Google users through push notifications

#342

Post by rootusrootus »

alberth wrote: post #336

I'm probably naive, but what insights could a government gleam from Push Notifications? And why aren't push notifications E2EE?

> I'm probably naive, but what insights could a government gleam from Push Notifications?

Looking at my own phone right now, it just got a push notification that my wife has arrived at home. That could be useful if you wanted to track my wife.

> And why aren't push notifications E2EE?

That's a great question. And I hope the answer is "we're on it, they will be E2EE in the next release."

Re: Governments spying on Apple, Google users through push notifications

#343

Post by beretguy »

zogrodea wrote: post #321
beretguy wrote: post #174

Earlier quoted context omitted.

So, don’t have Twitter account and/or app installed and you should be good?

I think your comment comes after reading this line: > - targeted users(s) following “foo” on X app It seems "X app" means just any placeholder app (not the new Twitter rebrand), although I might be wrong.

Correct. That’s why I will continue calling it Twitter, to avoid confusions like this.

Re: Governments spying on Apple, Google users through push notifications

#345

Post by satchlj »

tantalor wrote: post #322
seanw265 wrote: post #160

Earlier quoted context omitted.

I'm not so familiar with Signal, but could you explain why you would expect Signal notifications to happen out-of-band with normal push notifications? Assuming Signal sends push notifications of some sort, as most messaging services do, that would make them vulnerable to the metadata-level attacks described in this thread. What kind of "out-of-band" are you thinking of that would mitigate this issue?

Why: because otherwise the service, which is supposed to be private, is no longer private. I dunno how it would work, maybe something like a third-party push? Why does everything have to be channeled through central service? A service like Signal could operate its own push channel.

Notice how SimpleX (https://simplex.chat/) has no push notifications by default because of this issue.

Re: Governments spying on Apple, Google users through push notifications

#346

Post by satchlj »

dylan604 wrote: post #225
tantalor wrote: post #120

Earlier quoted context omitted.

That doesn't make sense. I would expect Signal notifications to happen completely out-of-band with "normal" push notifications (e.g. NYT news alert). Otherwise that completely defeats the purpose of the service. Basically you're saying Apple/Google are MITM'ing Signal.

no, that's not basically it. MITM to me means being able to read the data by placing yourself in the encrypted chain. that's not how push notifications work. they don't need to know the contents of the message

The notification is separate from the message. It absolutely is MITM, just for the notifications, which are messages themselves with real content (you have received a message from so-and-so).

Re: Governments spying on Apple, Google users through push notifications

#347

Post by wharvle »

Nifty3929 wrote: post #310
TheRealDunkirk wrote: post #303

It's crazy to me that so much effort is being expended pretending that companies and the government are doing anything in the name of privacy, when we have all the proof by Assange and Snowden that they're doing realtime surveillance of ALL communications, 24x7 -- no matter what any laws say -- and we don't even talk about it any more. What's the point of any of this? All we can do is assume that our every position,…

I think where we go wrong is to allow the conversation to revolve around what evil corporations are doing with our information, rather than what the evil government is doing with it. I believe the risk to our freedom is much greater from the latter. Of course governments can extract the information from corporations that have it, but let's keep the spotlight on the government itself, and use THAT as a reason to give…

> Of course governments can extract the information from corporations that have it, but let's keep the spotlight on the government itself, and use THAT as a reason to give corps less information about us.

Yep. Treating the two as distinct makes no sense. Corporate dragnet surveillance collecting forever-datasets isn't meaningfully different from the government doing the same thing, directly. People who fear government power ought to support outlawing corporate collection of the same types of things they don't want government collecting.

Granted that's relying on the government to prevent corporations from doing things in order to limit... the government (and, incidentally and IMO beneficially, also the corporations themselves). However, that's the only effective mechanism we've got—and the basis of all the other mechanisms we have available, ultimately, short of violence and strikes and such—and I think it's implausible that, even assuming a great deal of bad-faith behavior, such a move wouldn't significantly curb this activity.

Re: Governments spying on Apple, Google users through push notifications

#348

Post by mitchitized »

Nifty3929 wrote: post #310
TheRealDunkirk wrote: post #303

It's crazy to me that so much effort is being expended pretending that companies and the government are doing anything in the name of privacy, when we have all the proof by Assange and Snowden that they're doing realtime surveillance of ALL communications, 24x7 -- no matter what any laws say -- and we don't even talk about it any more. What's the point of any of this? All we can do is assume that our every position,…

I think where we go wrong is to allow the conversation to revolve around what evil corporations are doing with our information, rather than what the evil government is doing with it. I believe the risk to our freedom is much greater from the latter. Of course governments can extract the information from corporations that have it, but let's keep the spotlight on the government itself, and use THAT as a reason to give…

Wouldn't the exact opposite focus have a better effect? Going after the "evil corporations" would mean nobody was collecting the data in the first place, which would also take away the "evil government" as they have nobody to buy that data from.

Right now they just write fat checks to Google, Apple, Amazon and the telcos and badda bing, badda boom it's done.

Re: Governments spying on Apple, Google users through push notifications

#349

Post by fsflover »

Klonoar wrote: post #330
fsflover wrote: post #296

Earlier quoted context omitted.

Alternatively, consider Librem 5, which is more stable, since its software is developed by a dedicated team.

Librem needs to do something PR-wise to fix the reputation they developed regarding massive product/delivery delays. They exist in the frustrating spot of “I want to like them, but I can’t trust the purchase based off of everyone I know who tried getting burned, so now I’ll just look at a Pinephone because it’s easier”.

I don't understand how delays of preorders are relevant today, when the devices are available within 10 working days.

Re: Governments spying on Apple, Google users through push notifications

#350

Post by staplers »

xyst wrote: post #150

Would be great to see an example of notification metadata that can supposedly link it to real users. Seems like this is what is being implied: Given: - users with notifications enabled - have X app installed - targeted user(s) reside in USA - targeted users(s) following “foo” on X app When: - issue FISA warrant for all smartphone users that received notifications in regards to “foo” user Then: - able to pull all Appl…

Apple's own developer documentation outlines how notifications can trigger when crossing a physical boundary.

Apps notifications can trigger if you enter a "protest zone" for example then gov will know everyone who was there.

Post reply on HN