Why didn't Apple pull the plug on these services as soon as the government started spying with them? Why didn't they rearchitect them to use E2E encrypt? Do they actually have principles about privacy or is it just a thing they want us to believe?
Governments spying on Apple, Google users through push notifications
571–580 of 649 posts
Re: Governments spying on Apple, Google users through push notifications
#572Earlier quoted context omitted.
No, you do not need this just for decryption. This entitlement is only required if you want your Notification Extension to be able to silently eat the notification. Normally an extension must transform the notification then the system presents it to the user. APNS is not a "let my server wake up my app in the background whenever and however often I like" mechanism. Defer handling other things until either your extens…
When you're transforming the push notification, can you make an https request? Send a meaningless random ID, then do a get request to your API to get the actual content, then present it to the user. Only a meaningless ID will transit through google/apple servers. Honest question. I'm sure many thought about it before.
You can do quite a few things - it’s not a widely written about area of development (relatively speaking) but you have a surprising amount of stuff at your fingertips.
I built a finance app a few years ago that would take market data via a push notification, and then the transform extension would render it to a chart image and attach the image to the notification to avoid generating them server side.
Re: Governments spying on Apple, Google users through push notifications
#573Does this mean governments can intercept and possibly interact with the “This was me” 2FA notifications that a few apps are using now?
Re: Governments spying on Apple, Google users through push notifications
#574Earlier quoted context omitted.
When you're transforming the push notification, can you make an https request? Send a meaningless random ID, then do a get request to your API to get the actual content, then present it to the user. Only a meaningless ID will transit through google/apple servers. Honest question. I'm sure many thought about it before.
You can do quite a few things - it’s not a widely written about area of development (relatively speaking) but you have a surprising amount of stuff at your fingertips. I built a finance app a few years ago that would take market data via a push notification, and then the transform extension would render it to a chart image and attach the image to the notification to avoid generating them server side.
> You can do quite a few things - it’s not a widely written about area of development (relatively speaking) but you have a surprising amount of stuff at your fingertips.
I would pay to commission a blog post on the topic if you’re willing to write it.
Re: Governments spying on Apple, Google users through push notifications
#575I'm surprised hyper-private services like Signal haven't foreseen this as a potential vector and given you options to eg. exclude different details from push notifications (or warned you to disable them altogether if you're worried about it)
My Signal notifications on iOS just say 'Message received!', not sure what else is in the payload but nothing else is displayed... It seems unfathomable that they would push any unencrypted message content or information relating to who is messaging you through notifications that travel over third party servers, so I very much doubt there's much of interest in the payload...
Re: Governments spying on Apple, Google users through push notifications
#576Earlier quoted context omitted.
IP geolocation isn’t exactly the most precise though. 600M+ IPs have a default location to some farm in Kansas [1] [1] https://www.washingtonpost.com/news/morning-mix/wp/2016/08/1...
I should have been more specific. Although they could use IP geolocation, they can also get data from the cell carrier that delivered the notification to that IP address. So a gov finds that IP address 7.8.9.0 received one of these notifications at 12:34. They then see that 7.8.9.0 is one of ATT’s addresses. They go to ATT and learn that address was used by their customer onionisafruit at 12:34 and the device was 5ms…
That's hardly necessary. I think the attack goes like this:
You have captured the device of some group member, and you want to investigate his associates, but you don't know who they are. So you ask Google and Apple: Make a list of all of the devices that have received a push notification sent by where those devices have received at least 200 notifications within 50ms of a notification received by this device. (You will have to make Google or Apple share the list with the target timings with the other)
That will give you a list of everyone who is in a group chat with your target, regardless of whether or not the messages were deleted or encrypted. Now you tell Apple/Google to give all the data on those accounts. You will probably find enough in their Gmail/location history/browsing history to identify nearly all associated people without ever bothering to look at IP addresses.
This also works if you get into a chat with your target. You send some messages and then have Google/Apple identify their device via timing, then identify all their associates.
Re: Governments spying on Apple, Google users through push notifications
#577Earlier quoted context omitted.
The good thing is we live in a democracy - if we don't like it, we can fix it at the voting booth.
No you can't. You only get to vote for the candidates on the ballot. And they'll get corrupted within a term, usually.
GP is being ironic.
That said, I also think things happen way before the first term. It requires consent of the Party to get on the ballot and hundreds of millions of dollars, increasingly trending towards billions, to run a campaign with a chance of winning, because in a democracy it's quite self evident that the person who spends the most money, must be the better person. Results don't lie!
And on top of all of this, if you aren't shaping up to be who the Party wants, then the completely independent, free, and honest media will demonize you. And even if this doesn't destroy you in the eyes of your own supporters, it'll rile up your opponent's base enough as they race to vote (for somebody they also don't even particularly care for) because if they don't, then you might win! That cannot be allowed to happen as it would obviously be the literal end of the world.
This is why it's ever more important for social media to be controlled, lest somebody angle-shoot around the traditional path to success - the media. If somebody's gaining traction on social media, then he's saying things that disagree with the powers that be. Since he's disagreeing with the powers that be, he is spreading misinformation by definition, so he must be censored. For our safety.
Re: Governments spying on Apple, Google users through push notifications
#578Earlier quoted context omitted.
He even inspired Snowden to expose the illegal mass surveillance programs. IIRC Snowden reached a breaking point when James Clapper, then director of national intelligence, lied under oath to Congress when pressed about domestic surveillance by senator Wyden. It's sad we don't hear more about people like this in positions of power.
Good thing there is no penalties for lying under oath anymore. That pesky rule of law was so long in the tooth.
Penalties for whom? Clapper was bound by conflicting laws requiring both honesty and secrecy. This problem goes all the way to the root of government and legal system.
Re: Governments spying on Apple, Google users through push notifications
#579> " "In this case, the federal government prohibited us from sharing any information," the company said in a statement. "Now that this method has become public we are updating our transparency reporting to detail these kinds of requests." " When they were building the CSAM detector: "what if the government asks you to extend the detection to include other media such as political meme images?" "we would refuse".
wow. Yahoo have a better track record than google or apple on figthing against that https://money.cnn.com/2014/09/11/technology/security/yahoo-f... I guess now the yahoo phone doesn't sound like that bad of a joke https://www.slashgear.com/wp-content/uploads/2010/05/nokia_y...
Re: Governments spying on Apple, Google users through push notifications
#580I must be fundamentally missing something here. I thought all this data scooping was to find the bad guys. Are the bad guys really so stupid as to use Apple or Android (or any closed system) to communicate? Cryptonomicon was written 25 year ago.