Live data from Hacker News

Governments spying on Apple, Google users through push notifications

reuters.com

531–540 of 649 posts

Re: Governments spying on Apple, Google users through push notifications

#531

With respect to the US, I would be more worried about Apple and Google spying on users through push notifications. Americans have legal protections against government spying but they have basically zero protections against spying by so-called "tech" companies. Neither Apple nor Google can demand information about citizens from the government, but the government can demand this from Apple or Google, which they do, suc…

Are the legal protections against government spying actually worth anything though?

Eg. Parallel construction, FISA, etc etc.

But also, you're whispering right in that if Google and Apple are able to do this, then is that "laundered" spying, I'm that various law enforcement and government agencies can buy this information?

Re: Governments spying on Apple, Google users through push notifications

#532
post #150

Would be great to see an example of notification metadata that can supposedly link it to real users. Seems like this is what is being implied: Given: - users with notifications enabled - have X app installed - targeted user(s) reside in USA - targeted users(s) following “foo” on X app When: - issue FISA warrant for all smartphone users that received notifications in regards to “foo” user Then: - able to pull all Appl…

Apple's own developer documentation outlines how notifications can trigger when crossing a physical boundary. Apps notifications can trigger if you enter a "protest zone" for example then gov will know everyone who was there.

Need a set of preparation rules for attending protests these days.

No mobile, no identification, obscure any way to uniquely be identified.

Re: Governments spying on Apple, Google users through push notifications

#533

Legitimately scary stuff but not surprising. Snowden risked everything to tell us what was going on and where things were headed yet here we are. At this point, it seems the only way to not be subject to this type of treatment by our governments is to completely unplug from the system, but of course, practically speaking, this isn’t feasible for the overwhelming majority of our society. So what are the alternatives h…

> So what are the alternatives here?

You have to be willing to live with something less feature-rich than what you can get on the latest iPhone 27 Max Pro(TM). And you have to be gutsy enough to click an "Install some other OS" button in your web browser with your phone plugged into a USB port.

Then to extend to services, a lot of it depends on your ability to deploy your own stuff. This can involve a lot of time reading how-to guides after you've installed Linux on a machine in your house. Given how much documentation is readily available online most people with a high school diploma can probably figure it all out, but you have to be motivated enough to refuse to be helpless.

Today you can purchase a Pixel 7[|a|Pro] and flash GrapheneOS on it. There's a lot you can get from F-Droid, but if you really want Google Play Store apps, GrapheneOS does a reasonable job sandboxing it. Create a new Google account just for that installation of Google Play Store.

Never sign into anything Google, Microsoft, Apple, Facebook, Twitter/X, LinkedIn, or whatever from your phone. Or at least if you absolutely have to, use a trusted web browser in Incognito or Private Browsing Mode.

Keep location tracking disabled for everything but your favorite maps app. Put your phone in Airplane Mode when you're traveling if you don't want cell towers to capture your location info. GPS reception still works.

WG Tunnel can get you to your server when you're not on your home network. Some people swear by Tailscale, but you have to trust them with your node info.

Syncthing works for backup for a lot of people.

For private maps I've been using Organic Maps with some success. Searching for places isn't necessarily trivial, but the navigation feature has always worked well for me.

For private comms you really need it to go both ways (you and the recipient). The weak point is likely to be the recipient's environment, but at least something like Signal gives you a chance.

Something like Fastmail works for email and calendar, since they're probably not building a profile on you and selling that to advertisers. DAVx5 is free from F-Droid for calendar sync.

Kagi works really well for search. Also, they probably haven't sold out to advertisers. DuckDuckGo is another option with another set of trade-offs.

For music you can serve FLAC files via minidlnad to VLC. minidlnad was a 3-minute tweak to a config file after I apt-got it. There are tons of options here.

Explore F-Droid for stuff that might do better for privacy, like Spotube, FreeOTP, Podverse, Librara FD, Cheogram, etc. I'm not claiming that the F-Droid apps will all give you perfect privacy, but in general they're probably better than a lot of the stuff that's pushed in the Play store.

Check out e-books and audiobooks from your local library. Or copy them to your device via Syncthing after feeding your e-books through Calibre's DeDRM extension. The idea is to keep from having to context license servers from your phone.

Give up on Apple or Google Pay, credit cards, and loyalty programs if you don't want your eReceipts collected and added to your consumer profile by companies that do that sort of thing.

None of this is a surefire way to give yourself perfect privacy, but it can greatly reduce the amount of your personal information that your government and/or corporations collect on you via your mobile device.

Re: Governments spying on Apple, Google users through push notifications

#534

With respect to the US, I would be more worried about Apple and Google spying on users through push notifications. Americans have legal protections against government spying but they have basically zero protections against spying by so-called "tech" companies. Neither Apple nor Google can demand information about citizens from the government, but the government can demand this from Apple or Google, which they do, suc…

FYI what you're describing is https://en.wikipedia.org/wiki/Third-party_doctrine

Re: Governments spying on Apple, Google users through push notifications

#535

Earlier quoted context omitted.

I imagine they designed it the way they did specifically to prevent law enforcement from tapping them.

Not law enforcement, but random punks. Law enforcement can get your airtag private keys from your iCloud backup.

That’s not how an AirTag works. Anyone can request any AirTag by simply knowing the public key (which is broadcast via BLE). Then you just need the private key which doesn’t need to be backed up by disabling keychain backups.

Re: Governments spying on Apple, Google users through push notifications

#536
post #352

One question I have as someone who tries to maintain (some) data sovereignty: is there any way as an end-user to circumvent/mitigate this kind of surveillance — aside from abandoning iOS and Android completely?

Read at least the summary of James Scott's Seeing Like a State ( https://en.wikipedia.org/wiki/Seeing_Like_a_State ) and let the concept of legibility percolate for a bit. Governments view legibility of their constituencies as a feature, not a bug. They want to be able to query the population like a database in order to manage it better. This is exactly like a product manager at a tech company who wants to know wheth…

Oh boy. I was shaking my head in agreement while reading your comment, until that part:

> Why HNers are pro-VPN but anti-Bitcoin, when both stand for privacy and censorship resistance at the price of reduced legibility, is beyond me.

neither vpn nor btc are "for privacy and censorship resistance". Maybe in some dystopian neoliberal every-man-is-an-island way. I think you were thinking about "overlay networks (tor et al) and communal economies" maybe? Those would fit with the rest of the claims.

Re: Governments spying on Apple, Google users through push notifications

#537
post #509

We at the Home Assistant Companion for iOS team have been wanting to implement end to end encryption for our push notifications for a while now but Apple has denied our request for the com.apple.developer.usernotifications.filtering [0] entitlement multiple times. Wondering if with today's news we could apply again and get it. For context, we are sending ~35 million push notifications per month on iOS and ~67 million…

We implemented APNS encryption for Firefox iOS without much trouble. Keys are negotiated out of band and message decryption is done in a Notification extension that allows you to pre process incoming notifications. Did not need any special entitlements. Source code on GitHub.com/mozilla-mobile

Maybe their keys are safer than yours?

Not saying you are obviously compromised, but the simplest explanation after this news is that maybe they relay the authorization to NSA et al, and they OK'ed your case and not theirs for some reason...

Re: Governments spying on Apple, Google users through push notifications

#538

Earlier quoted context omitted.

Good thing there is no penalties for lying under oath anymore. That pesky rule of law was so long in the tooth.

Google tells me perjury is still very much a thing. Do you have a source?

[flagged]

Re: Governments spying on Apple, Google users through push notifications

#539

Earlier quoted context omitted.

wow. Yahoo have a better track record than google or apple on figthing against that https://money.cnn.com/2014/09/11/technology/security/yahoo-f... I guess now the yahoo phone doesn't sound like that bad of a joke https://www.slashgear.com/wp-content/uploads/2010/05/nokia_y...

Better public track record. It's very difficult to reason about a hidden private track record.

[flagged]

Re: Governments spying on Apple, Google users through push notifications

#540

Legitimately scary stuff but not surprising. Snowden risked everything to tell us what was going on and where things were headed yet here we are. At this point, it seems the only way to not be subject to this type of treatment by our governments is to completely unplug from the system, but of course, practically speaking, this isn’t feasible for the overwhelming majority of our society. So what are the alternatives h…

> So what are the alternatives here? You have to be willing to live with something less feature-rich than what you can get on the latest iPhone 27 Max Pro(TM). And you have to be gutsy enough to click an "Install some other OS" button in your web browser with your phone plugged into a USB port. Then to extend to services, a lot of it depends on your ability to deploy your own stuff. This can involve a lot of time rea…

You have to do both unfortunately, otherwise the lack of a trackable identity in itself will make you a huge target for surveillance.
Post reply on HN