Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Governments spying on Apple, Google users through push notifications

reuters.com

Post reply on HN
Print view View original

551–560 of 649 posts

Re: Governments spying on Apple, Google users through push notifications

#551

Post by smashed »

xenadu02 wrote: post #530
michh wrote: post #317

Earlier quoted context omitted.

for my understanding, you need that entitlement so you can send an encrypted invisible notification which you can then decrypt locally in your app and push out again as a local notification that doesn't go over the network (i.e. not use apns)? Or is doing this kind of stuff just weirdly tied to that specific entitlement?

No, you do not need this just for decryption. This entitlement is only required if you want your Notification Extension to be able to silently eat the notification. Normally an extension must transform the notification then the system presents it to the user. APNS is not a "let my server wake up my app in the background whenever and however often I like" mechanism. Defer handling other things until either your extens…

When you're transforming the push notification, can you make an https request?

Send a meaningless random ID, then do a get request to your API to get the actual content, then present it to the user.

Only a meaningless ID will transit through google/apple servers.

Honest question. I'm sure many thought about it before.

Re: Governments spying on Apple, Google users through push notifications

#553

Post by 1oooqooq »

sowbug wrote: post #547
1oooqooq wrote: post #536

Earlier quoted context omitted.

Oh boy. I was shaking my head in agreement while reading your comment, until that part: > Why HNers are pro-VPN but anti-Bitcoin, when both stand for privacy and censorship resistance at the price of reduced legibility, is beyond me. neither vpn nor btc are "for privacy and censorship resistance". Maybe in some dystopian neoliberal every-man-is-an-island way. I think you were thinking about "overlay networks (tor et…

The actual mechanisms don't matter that much. The point is not letting government or big corporations default to being the gatekeepers for (or monitors of) basic -- and legal -- social activities like communicating or transferring value. Information technology has shrunk the world, but our rights shouldn't also shrink.

I'm not talking about a choice of implementation. I'm pointing out you suggested a brick wall for a road. It's not picking a dirty road or asphalt. it's a wall. it's not a fitting concept.

but again, you are correct on the concepts. I would only add that corporations and gov are not that separate as you think. They have that power because they must have that power. capital will flow. rentiers will get paid. and those rentiers either have connections or they are the inteligence agencies. Do you think cesar could just fire the praetorian guard?

Re: Governments spying on Apple, Google users through push notifications

#554

Post by SturgeonsLaw »

mistermann wrote: post #543
soraminazuki wrote: post #415

Earlier quoted context omitted.

There are instead life destroying penalties being handed out to whistleblowers. What a world we live in.

The good thing is we live in a democracy - if we don't like it, we can fix it at the voting booth.

We can vote for a blue boot on our neck or a red boot on our neck

Re: Governments spying on Apple, Google users through push notifications

#555

Post by 93po »

jay-barronville wrote: post #425

Legitimately scary stuff but not surprising. Snowden risked everything to tell us what was going on and where things were headed yet here we are. At this point, it seems the only way to not be subject to this type of treatment by our governments is to completely unplug from the system, but of course, practically speaking, this isn’t feasible for the overwhelming majority of our society. So what are the alternatives h…

> So what are the alternatives here?

Conduct yourself on your phone the way you would in public in front of friends and family. Only text/browse with stuff you'd be okay with a stranger knowing. I've operated this way for many years for the exact reason that this article highlights.

Re: Governments spying on Apple, Google users through push notifications

#556

Post by fragmede »

staplers wrote: post #350
xyst wrote: post #150

Would be great to see an example of notification metadata that can supposedly link it to real users. Seems like this is what is being implied: Given: - users with notifications enabled - have X app installed - targeted user(s) reside in USA - targeted users(s) following “foo” on X app When: - issue FISA warrant for all smartphone users that received notifications in regards to “foo” user Then: - able to pull all Appl…

Apple's own developer documentation outlines how notifications can trigger when crossing a physical boundary. Apps notifications can trigger if you enter a "protest zone" for example then gov will know everyone who was there.

Hey, that's easier than having to go there and setup a stingray!

Re: Governments spying on Apple, Google users through push notifications

#557

Post by [deleted] »

st3fan wrote: post #509
robbiet480 wrote: post #306

We at the Home Assistant Companion for iOS team have been wanting to implement end to end encryption for our push notifications for a while now but Apple has denied our request for the com.apple.developer.usernotifications.filtering [0] entitlement multiple times. Wondering if with today's news we could apply again and get it. For context, we are sending ~35 million push notifications per month on iOS and ~67 million…

We implemented APNS encryption for Firefox iOS without much trouble. Keys are negotiated out of band and message decryption is done in a Notification extension that allows you to pre process incoming notifications. Did not need any special entitlements. Source code on GitHub.com/mozilla-mobile

[deleted]

Re: Governments spying on Apple, Google users through push notifications

#558

Post by averageRoyalty »

steelframe wrote: post #533
jay-barronville wrote: post #425

Legitimately scary stuff but not surprising. Snowden risked everything to tell us what was going on and where things were headed yet here we are. At this point, it seems the only way to not be subject to this type of treatment by our governments is to completely unplug from the system, but of course, practically speaking, this isn’t feasible for the overwhelming majority of our society. So what are the alternatives h…

> So what are the alternatives here? You have to be willing to live with something less feature-rich than what you can get on the latest iPhone 27 Max Pro(TM). And you have to be gutsy enough to click an "Install some other OS" button in your web browser with your phone plugged into a USB port. Then to extend to services, a lot of it depends on your ability to deploy your own stuff. This can involve a lot of time rea…

This is an excellent reference. It is worth emphasising though, this does not make the device secure.

No matter what OS you put on, there's still a proprietary baseband blob with executuon permissions underneath. All of these devices are built compromised.

Re: Governments spying on Apple, Google users through push notifications

#559

Post by linuxandrew »

jay-barronville wrote: post #425

Legitimately scary stuff but not surprising. Snowden risked everything to tell us what was going on and where things were headed yet here we are. At this point, it seems the only way to not be subject to this type of treatment by our governments is to completely unplug from the system, but of course, practically speaking, this isn’t feasible for the overwhelming majority of our society. So what are the alternatives h…

Unshackle yourself from Google/Apple and use F-Droid/LineageOS or something similarly FOSS minded.
Post reply on HN