Governments spying on Apple, Google users through push notifications • Hacker News Board

Re: Governments spying on Apple, Google users through push notifications

#381

Post by alberth » Wed, Dec 06, 2023, 5:33 PM UTC

rootusrootus wrote: post #342

alberth wrote: post #336

I'm probably naive, but what insights could a government gleam from Push Notifications? And why aren't push notifications E2EE?

> I'm probably naive, but what insights could a government gleam from Push Notifications? Looking at my own phone right now, it just got a push notification that my wife has arrived at home. That could be useful if you wanted to track my wife. > And why aren't push notifications E2EE? That's a great question. And I hope the answer is "we're on it, they will be E2EE in the next release."

Does the push notification indicate where (location) home is?

Re: Governments spying on Apple, Google users through push notifications

#382

Post by Hizonner » Wed, Dec 06, 2023, 5:33 PM UTC

forward1 wrote: post #311

JohnFen wrote: post #213

Earlier quoted context omitted.

In practice, "reasonable suspicion" means "whenever they want."

The potential to abuse power is not a reason to disavow it.

Yes, yes it is.

Re: Governments spying on Apple, Google users through push notifications

#383

Post by 1oooqooq » Wed, Dec 06, 2023, 5:34 PM UTC

jodrellblank wrote: post #327

> " "In this case, the federal government prohibited us from sharing any information," the company said in a statement. "Now that this method has become public we are updating our transparency reporting to detail these kinds of requests." " When they were building the CSAM detector: "what if the government asks you to extend the detection to include other media such as political meme images?" "we would refuse".

wow. Yahoo have a better track record than google or apple on figthing against that https://money.cnn.com/2014/09/11/technology/security/yahoo-f...

I guess now the yahoo phone doesn't sound like that bad of a joke https://www.slashgear.com/wp-content/uploads/2010/05/nokia_y...

Re: Governments spying on Apple, Google users through push notifications

#384

Post by [deleted] » Wed, Dec 06, 2023, 5:34 PM UTC

fsflover wrote: post #139

2OEH8eoCRo0 wrote: post #131

Earlier quoted context omitted.

That's a stretch, you can use social engineering to do essentially anything then.

Not if you know nothing about your target.

[deleted]

Re: Governments spying on Apple, Google users through push notifications

#385

Post by fsflover » Wed, Dec 06, 2023, 5:36 PM UTC

alberth wrote: post #336

I'm probably naive, but what insights could a government gleam from Push Notifications? And why aren't push notifications E2EE?

https://news.ycombinator.com/item?id=38544063

Re: Governments spying on Apple, Google users through push notifications

#386

Post by eks391 » Wed, Dec 06, 2023, 5:38 PM UTC

colordrops wrote: post #368

pphysch wrote: post #361

Earlier quoted context omitted.

This is such a strange position for me. Do we not agree that corporate America and other special interest groups essentially control Washington via lobbying and corruption? Do we not agree that a US citizen has (nominally) more leverage over their government than over an unaccountable private collective? I mean, we are half a century deep into this Reaganite "your government is your enemy" experiment.

https://www.princeton.edu/~mgilens/idr.pdf

I'm getting a blank page from your link

Re: Governments spying on Apple, Google users through push notifications

#387

Post by rangerelf » Wed, Dec 06, 2023, 5:38 PM UTC

colordrops wrote: post #368

pphysch wrote: post #361

Earlier quoted context omitted.

This is such a strange position for me. Do we not agree that corporate America and other special interest groups essentially control Washington via lobbying and corruption? Do we not agree that a US citizen has (nominally) more leverage over their government than over an unaccountable private collective? I mean, we are half a century deep into this Reaganite "your government is your enemy" experiment.

https://www.princeton.edu/~mgilens/idr.pdf

You already mentioned this higher in the thread, no need to repeat yourself.

For the record I agree with the grandparent post's question: at least, gov is _supposed_ to be controlled by the citizenry through elections, corporations are not. I can have ("should have") visibility into what the government is doing, corporations can hide (and do hide) as much real information as they can and there's no way for me to get to it.

Whether it's naive of me to think so or not is not what is being discussed here.

Re: Governments spying on Apple, Google users through push notifications

#388

Post by just_steve_h » Wed, Dec 06, 2023, 5:39 PM UTC

riversflow wrote: post #378

unyttigfjelltol wrote: post #355

Earlier quoted context omitted.

Thirty years ago, one perceived element of moral superiority in the West was revelations of the extensive internal surveillance in places like East Germany and own-spying. There used to be news items and documentaries mocking this behavior and intimating how backward and uncouth those governments were to stoop to furiously wiretapping irrelevant private conversations. So, whether the world has changed enough to justi…

Meh, collecting information is different from acting on it. My underdtaning, which could be wrong, was that people legitimately lived in fear of getting found out by the stazi. There isn’t a good reason to fear the NSA based on current actions, that I’m aware of anyway.

I’m afraid the NSA regularly funnels information to the FBI and other domestic policing entities, and this has been widely documented [1]. The government even deigned to declassify proceedings from their special secret (!) court that decry the practice where NSA gives illegally-obtained surveillance to the FBI, which then manufactures a reason to go after someone using a technique known as “parallel construction,” concealing the surveillance source(s).

[1] https://theintercept.com/2019/10/10/fbi-nsa-mass-surveillanc...

Re: Governments spying on Apple, Google users through push notifications

#389

Post by albatrossjr » Wed, Dec 06, 2023, 5:40 PM UTC

robbiet480 wrote: post #306

We at the Home Assistant Companion for iOS team have been wanting to implement end to end encryption for our push notifications for a while now but Apple has denied our request for the com.apple.developer.usernotifications.filtering [0] entitlement multiple times. Wondering if with today's news we could apply again and get it. For context, we are sending ~35 million push notifications per month on iOS and ~67 million…

Just curious, why do you need filtering permissions for your use case?

Decrypting a push notification appears to be supported using 'mutable-content' with a notification service.

In fact that is the example used here: https://developer.apple.com/documentation/usernotifications/...

Re: Governments spying on Apple, Google users through push notifications

#390

Post by callalex » Wed, Dec 06, 2023, 5:43 PM UTC

staplers wrote: post #350

xyst wrote: post #150

Would be great to see an example of notification metadata that can supposedly link it to real users. Seems like this is what is being implied: Given: - users with notifications enabled - have X app installed - targeted user(s) reside in USA - targeted users(s) following “foo” on X app When: - issue FISA warrant for all smartphone users that received notifications in regards to “foo” user Then: - able to pull all Appl…

Apple's own developer documentation outlines how notifications can trigger when crossing a physical boundary. Apps notifications can trigger if you enter a "protest zone" for example then gov will know everyone who was there.

That location determination is done on-device.