Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Governments spying on Apple, Google users through push notifications

reuters.com

Post reply on HN
Print view View original

631–640 of 649 posts

Re: Governments spying on Apple, Google users through push notifications

#631

Post by hedora »

kccqzy wrote: post #546
hedora wrote: post #438

Earlier quoted context omitted.

Apple AirDrop was basically this, but they neutered it at the request of the Chinese government. It still works, but it automatically turns itself off every 30 minutes, so you can't (for instance) opt-in to allowing people to automatically push uncensored news to your phone during your daily commute (without interacting with the phone every half hour). (It isn't technically a mesh, since it doesn't support multi-hop…

A better example is perhaps Apple's Find My network in which they explicitly said that locations of your Apple devices (including AirTags) would be transmitted over a mesh network and eventually to Apple's servers so you can see them on your iCloud console.

From an anti-censorship / user interface perspective, AirDrop is closer to the mesh network dream, but, yeah, from a network topology perspective, Find My is an actual mesh network, and AirDrop is not.

I'd love to see something with the characteristics of Find My, but open to arbitrary data transfers. The cell connectivity in my area is poor (due to monopolies not bothering to build out infrastructure, unless you believe there's no demand for network connectivity in the SF Bay Area...), and most places I drive to have guest wifi networks anyway.

I can easily imagine dropping my cell phone plan and only being available for high-latency text messages (and emergency calls to 911) when out and about.

Re: Governments spying on Apple, Google users through push notifications

#632

Post by lilsoso »

bkallus wrote: post #232
fsflover wrote: post #208

Earlier quoted context omitted.

Also, no Signal.

This isn't necessarily true. When you install the Signal app on an Android phone that doesn't have Google Play Services installed, it receives push notifications using its own notification daemon instead of using Google's. This, of course, has significant battery life costs.

Thank you, I was looking for this answer. Signal, therefore, as a I understand it, is not vulnerable to this issue.

Re: Governments spying on Apple, Google users through push notifications

#633

Post by mistermann »

somenameforme wrote: post #628
mistermann wrote: post #612

Earlier quoted context omitted.

Very much agree. I would like to ask you a serious question: do you not think it is extremely weird that so many people will at least sometimes [1] agree that "democracy" is essentially fake, but then at other times take quite literally the opposite stance...praising it, defending it, singing its virtues, etc? Granted, it is theoretically possible that each individual is 100% consistent at all times, and I am simply…

That's a very interesting observation that deserves much more thought that I can give in a quick reply. But I think one major issue is that we're living through an obvious inflection point in history. When the US was competing against the USSR, we achieved numerous objectively incredible things. For but one example, we went from having never put a single man in orbit in 1962, to putting a man on the Moon, in 7 years!…

This is all well and good, but I sincerely believe that it does not address the question: why are humans, including the genuinely much smarter than average folks here on HN, unable to have a very serious discussion about ~~whether~~ the degree to which "democracy" in the US (or Western countries in general), is fake?

I believe it is very fair to say that it is not a question of whether it is fake(!) at all (as a binary), but a question of how fake is it, and in what specific ways?

And yes, I can certainly appreciate why people would have an aversion to this, and the various other "just so" memes that are trotted out when the topic comes up, but the question remains: why is NO ONE capable of taking this topic very seriously?

Can you address that?

Re: Governments spying on Apple, Google users through push notifications

#634

Post by Forbo »

cscurmudgeon wrote: post #569
mandmandam wrote: post #486

Earlier quoted context omitted.

... None of your examples are like for like. Lots of people love the smell of cannabis. No one loves "trash in neighbors yards, loud sounds late at night, smells from chemical industries". Arguing in bad faith is lame dude.

Blatantly ignoring harms of secondhand weed is more lame: Second hand weed is harmful. https://www.uclahealth.org/news/secondhand-marijuana-smoke-w ...

I'm getting a 404 on this.

Re: Governments spying on Apple, Google users through push notifications

#635

Post by Klonoar »

toomuchtodo wrote: post #574
Klonoar wrote: post #572

Earlier quoted context omitted.

You can do quite a few things - it’s not a widely written about area of development (relatively speaking) but you have a surprising amount of stuff at your fingertips. I built a finance app a few years ago that would take market data via a push notification, and then the transform extension would render it to a chart image and attach the image to the notification to avoid generating them server side.

> You can do quite a few things - it’s not a widely written about area of development (relatively speaking) but you have a surprising amount of stuff at your fingertips. I would pay to commission a blog post on the topic if you’re willing to write it.

I unfortunately don't have time to do that, but I believe the Guardian did a similar trick some years ago for election result updates. Try googling around for that, it's very interesting reading.

Re: Governments spying on Apple, Google users through push notifications

#636

Post by Klonoar »

gimbalpirate wrote: post #584
Klonoar wrote: post #570

Earlier quoted context omitted.

Unless my memory is seriously off, Signal push notifications just tell your device to call and fetch. It’s not like they’re unaware and just sending you stuff in plain text.

Can you elaborate on this? I'm still not sure if Signal notifications are any less vulnerable than others.

The gist of it is that when Signal sends you a push notification, it's just a marker for "hey, you have updates". It doesn't contain unencrypted data that could be passed to another actor - Signal isn't stupid enough to do this. The app will then call out to pull down any updates.

Thus, we wind up in the following situation: the US govt could ask Apple for a list of people who got notifications at X/y/z time to try and tie it to someone who sent at those times, but Signal is so large and widely used that it'd be finding a needle in a haystack (and that's probably putting it lightly).

The news from this article is concerning, no doubt... but I'm not particularly worried about Signal is all.

Re: Governments spying on Apple, Google users through push notifications

#637

Post by somenameforme »

mistermann wrote: post #633
somenameforme wrote: post #628

Earlier quoted context omitted.

That's a very interesting observation that deserves much more thought that I can give in a quick reply. But I think one major issue is that we're living through an obvious inflection point in history. When the US was competing against the USSR, we achieved numerous objectively incredible things. For but one example, we went from having never put a single man in orbit in 1962, to putting a man on the Moon, in 7 years!…

This is all well and good, but I sincerely believe that it does not address the question: why are humans, including the genuinely much smarter than average folks here on HN, unable to have a very serious discussion about ~~whether~~ the degree to which "democracy" in the US (or Western countries in general), is fake? I believe it is very fair to say that it is not a question of whether it is fake(!) at all (as a bina…

I'd expect in this exact case the answer might be easier. It's because fake has an ambiguous meaning. It includes everything from the gamut of completely absurd such as elections aren't even actually happening, to the improbable but possible such as elections being rigged, to the self evident such as the people being elected, and their subsequent actions taken, being completely unrepresentative of the people or their interests.

And while all these topics (and many more) can be encompassed by 'fake', they all are quite radically different.

Re: Governments spying on Apple, Google users through push notifications

#638

Post by anonymouskimmer »

Forbo wrote: post #634
cscurmudgeon wrote: post #569

Earlier quoted context omitted.

Blatantly ignoring harms of secondhand weed is more lame: Second hand weed is harmful. https://www.uclahealth.org/news/secondhand-marijuana-smoke-w ...

I'm getting a 404 on this.

https://www.uclahealth.org/news/secondhand-marijuana-smoke-w...

Re: Governments spying on Apple, Google users through push notifications

#639

Post by steelframe »

flemhans wrote: post #544
steelframe wrote: post #533

Earlier quoted context omitted.

> So what are the alternatives here? You have to be willing to live with something less feature-rich than what you can get on the latest iPhone 27 Max Pro(TM). And you have to be gutsy enough to click an "Install some other OS" button in your web browser with your phone plugged into a USB port. Then to extend to services, a lot of it depends on your ability to deploy your own stuff. This can involve a lot of time rea…

We are headed in a direction where you will need the Google Play store or Apple's store to do groceries, read messages from the government, use two-factor authentication, pay, show your ID, order food, and much more. Web sites are being phased out and so are physical / legacy alternatives.

> We are headed in a direction

I feel that way too. Which is why I feel it's important to push back by at least asking every business whether they accept cash, and always using cash when they do. If they don't accept cash, I always make it a point to mention that they're paying processing fees for that transaction that they could have avoided if they accepted my cash instead. Simply raising the issue in a non-confrontational and casual way keep them thinking about it, which can lead to some of them acting on those thoughts after it happens often enough.

Simply acquiescing without any mention of cash makes one complicit in the pernicious slide toward a surveillance-infused market.

Re: Governments spying on Apple, Google users through push notifications

#640

Post by steelframe »

averageRoyalty wrote: post #558
steelframe wrote: post #533

Earlier quoted context omitted.

> So what are the alternatives here? You have to be willing to live with something less feature-rich than what you can get on the latest iPhone 27 Max Pro(TM). And you have to be gutsy enough to click an "Install some other OS" button in your web browser with your phone plugged into a USB port. Then to extend to services, a lot of it depends on your ability to deploy your own stuff. This can involve a lot of time rea…

This is an excellent reference. It is worth emphasising though, this does not make the device secure. No matter what OS you put on, there's still a proprietary baseband blob with executuon permissions underneath. All of these devices are built compromised.

Absolutely! I was focusing on moving toward a generally more privacy-centric way of using a mobile device. Of course an insecure device can be made to neutralize any privacy-protecting measures I've described. However just because a device has a vulnerability doesn't necessarily mean that it will be compromised. In fact I'd be surprised if there is more than, say, a 1% chance that any given random Pixel 7 phone is actually compromised via the baseband code.

Also, that said, if you are personally targeted by your government for surveillance, all bets are off. I don't know how to defend against that, but a potential start would be to eliminate all electronic devices from your person and your house and then to set off a powerful EMP every time you walk through your door when coming back home.

It's refreshing that Google, the same company that makes Android, has recently called out baseband blobs for their poor security.

https://googleprojectzero.blogspot.com/2023/03/multiple-inte...

Here's some discussion on the GrapheneOS forum:

https://discuss.grapheneos.org/d/3942-baseband-vulnerabiliti...

While I'm not convinced it's causing widespread exploitation, baseband blobs are definitely a problem, and hopefully some of the advocacy that Google's Android org puts on phone vendors can get us to a better place. And maybe efforts from organizations like Librem can push us toward modems with fully OSS firmware.

Post reply on HN