Live data from Hacker News

Governments spying on Apple, Google users through push notifications

reuters.com

501–510 of 649 posts

Re: Governments spying on Apple, Google users through push notifications

#501

Earlier quoted context omitted.

You're assuming that the shadow government can't or won't institute regime change when it's threatened. The US Government killed a president, why wouldn't it blackmail congress as well?

With this belief, does anything really matter?

you're right.... The CIA and, by extension, the US government as a whole (or any subgroup thereof) have never altered the outcome of elections anywhere for regime change, and have never instigated color revolutions for regime change.

Re: Governments spying on Apple, Google users through push notifications

#502

Push notifications are sent from an app server to an individual device, correct? And the device enrolls with the server for receiving push notifications. Why isn't there key exchange happening at the time of enrollment? Why is it something apps have to manually do? We moved the web to https everywhere for a reason, why are apps behind the web in privacy? Potentially stupid question - how is iMessage encrypted end to…

Apps can still do what they want in the content of the notification. This includes encrypting the content however they'd like. By default, though, apps don't encrypt the content. And the metadata (what appleID is receiving notifications from what app) is still known to Apple.

Re: Governments spying on Apple, Google users through push notifications

#503
post #422

Earlier quoted context omitted.

In practice, "reasonable suspicion" means "whenever they want."

If you're taking this view, any armed forces can do whatever they want and the constitution is just a piece of paper. In practice, the evidence gathered by unlawful searches is going to be discarded in a court of law. Other wise said, there is no carving in penal law for "100 miles " from the border.

> evidence gathered by unlawful searches is going to be discarded in a court of law

Maybe. Probably? But this isn't always the critical question.

Sometimes, "You May Beat the Rap, But You Can't Beat The Ride" is the problem.

Re: Governments spying on Apple, Google users through push notifications

#504

The only way out of this mess is with new laws and that will require new lawmakers. Any other solution - relying on the kindness of corporations, toiling away with obscure technologies, gong 'off the grid' - are all foolish or unrealistic for 99% or so of people and shouldn't even be considered. The most promising starting point is probably at the state level.

The Libertarian party might fit our needs for privacy, but very few people belong to the party. As a liberal, I started listening to the Ron Paul (Libertarian, retired US Senator) podcast at least once a week. Maybe because I am older, but what he says mostly makes sense to me. (Now I expect to get in trouble here because I mentioned a third party, that is fine with me.)

Problem is that US has two party system.

Re: Governments spying on Apple, Google users through push notifications

#505
post #261

Earlier quoted context omitted.

Because that's what the source said they are.

Pakistan?

Let me think - could it be the one country with a complicated situation where most of the security-services apparatus is nominally allied but actually supporting forces opposed to the US (talibans etc), with a sclerotic political system defaulting to military dictatorship every other decade; or the long-standing allied democracies (plural) with a well-documented history of structural cooperation in matters of espionage and surveillance, particularly at the IT level...? Which of the two would the US government rather let run surveillance on US citizens? Mmmh, I wonder!

/s

Re: Governments spying on Apple, Google users through push notifications

#506

Legitimately scary stuff but not surprising. Snowden risked everything to tell us what was going on and where things were headed yet here we are. At this point, it seems the only way to not be subject to this type of treatment by our governments is to completely unplug from the system, but of course, practically speaking, this isn’t feasible for the overwhelming majority of our society. So what are the alternatives h…

Are powerful mobile phones packed with Apps and constant notifications so necessary to a full, fun, enjoyable techy life, really? I am legitimately surprised that more tech-heads didn't see this state-of-affairs (and all the other obvious drawbacks of The World's Most Featureful Spy Device, controlled end-to-end by a giant multinational, becoming ubiquitous in peoples back pockets) as an obvious, absolute given, righ…

> I am legitimately surprised that more tech-heads didn't see this state-of-affairs

Didn't see or didn't bite the hand that feeds?

Re: Governments spying on Apple, Google users through push notifications

#507

We at the Home Assistant Companion for iOS team have been wanting to implement end to end encryption for our push notifications for a while now but Apple has denied our request for the com.apple.developer.usernotifications.filtering [0] entitlement multiple times. Wondering if with today's news we could apply again and get it. For context, we are sending ~35 million push notifications per month on iOS and ~67 million…

Naive question: why not remove all sensitive data, or all data, from the notification and leave the context for a secondary API call?

Re: Governments spying on Apple, Google users through push notifications

#508
post #212
post #186

Earlier quoted context omitted.

It certainly had an impact when Apple and Google shipped platform notifications because each of those systems kept the radio active. It’s possible that a better interface could be developed but it wouldn’t help privacy unless the implementers were in different legal jurisdictions: the same government which can subpoena or NSL Apple or Google could’ve asked e.g. Urban Airship for the same details. There’s also a chall…

It's a much bigger nuisance and risk to have several smaller parties to handle court orders; some of which could indeed be in other jurisdictions by the way. Before the platform notifications every single app kept their own connections open; allowing (completely) third part notification platforms would have a small or non-existent impact

> It's a much bigger nuisance and risk to have several smaller parties to handle court orders; some of which could indeed be in other jurisdictions by the way.

I’m not sure this is true: a small company is less likely to have the legal resources or confidence to stand up for their customers’ rights. I’m sure you could find examples going either way at either size.

Being in a different country helps but only if the company has sufficient security to even notice if the NSA decides to take advantage of them being outside of the US. I would bet Apple and Google have that level of expertise but not everyone else.

Re: Governments spying on Apple, Google users through push notifications

#509

We at the Home Assistant Companion for iOS team have been wanting to implement end to end encryption for our push notifications for a while now but Apple has denied our request for the com.apple.developer.usernotifications.filtering [0] entitlement multiple times. Wondering if with today's news we could apply again and get it. For context, we are sending ~35 million push notifications per month on iOS and ~67 million…

We implemented APNS encryption for Firefox iOS without much trouble. Keys are negotiated out of band and message decryption is done in a Notification extension that allows you to pre process incoming notifications. Did not need any special entitlements.

Source code on GitHub.com/mozilla-mobile

Re: Governments spying on Apple, Google users through push notifications

#510

We at the Home Assistant Companion for iOS team have been wanting to implement end to end encryption for our push notifications for a while now but Apple has denied our request for the com.apple.developer.usernotifications.filtering [0] entitlement multiple times. Wondering if with today's news we could apply again and get it. For context, we are sending ~35 million push notifications per month on iOS and ~67 million…

Naive question: why not remove all sensitive data, or all data, from the notification and leave the context for a secondary API call?

Yup that is also a great way. Just send a message ID and fetch the actual content in the notification extension that can pre process incoming notifications.
Post reply on HN