Earlier quoted context omitted.
> I wonder if this is a case of American intelligence outsourcing the surveillance of American citizens to foreign intelligence. If that is indeed the case, I’d expect a quid pro quo. Yet it is the US government who revealed it: "In a letter to the Department of Justice, Senator Ron Wyden said foreign officials were demanding the data from Alphabet's (GOOGL.O) Google and Apple (AAPL.O). Although details were sparse,…
> Yet it is the US government who revealed it Less "the government" and more "a member of government", the same member who has revealed and demanded accountability when discovering domestic government overreach. We should choose our congress critters carefully.
Governments spying on Apple, Google users through push notifications
121–130 of 649 posts
Re: Governments spying on Apple, Google users through push notifications
#122It's a huge problem for both privacy and the open source ecosystem that Apple and Google mandate use of their own notification system for apps to be included in their stores.
https://github.com/Telegram-FOSS-Team/Telegram-FOSS/blob/mas...
I doubt it solves much but I like to think of it as a little poke in the eye.
Re: Governments spying on Apple, Google users through push notifications
#123This, to me, is the more disturbing part of the article: > In this case, the federal government prohibited us from sharing any information," the company said in a statement. "Now that this method has become public we are updating our transparency reporting to detail these kinds of requests. What is the point of transparency reports if they don't include major vectors of government surveillance? IMO such gag orders sh…
Seems like a pretty open and shut case of unconstitutional restriction of speech in the US. Especially when you consider the wording of the Apple communication saying that they can talk about it openly now that it's public knowledge.
Hey we would like to bring suit because the government says we can't talk about them doing X. Oh no, that would be talking about doing X!!
Re: Governments spying on Apple, Google users through push notifications
#124This, to me, is the more disturbing part of the article: > In this case, the federal government prohibited us from sharing any information," the company said in a statement. "Now that this method has become public we are updating our transparency reporting to detail these kinds of requests. What is the point of transparency reports if they don't include major vectors of government surveillance? IMO such gag orders sh…
The feels.
Re: Governments spying on Apple, Google users through push notifications
#125Earlier quoted context omitted.
I so hate when people put words "only" and "metadata" in the same sentence... They know you rang a phone sex line at 2:24 am and spoke for 18 minutes. But they don't know what you talked about. They know you called the suicide prevention hotline from the Golden Gate Bridge. But the topic of the call remains a secret. They know you got an email from an HIV testing service, then called your doctor, then visited an HIV…
It's important but what do we do about it? You're using the internet afterall which isn't your network- it's someone else's! When you send a packet there is a header w/ information required for routing. Some call this the "outside of the envelope" if using the mail analogy. We can pass the buck by using a VPN but this also adds a VPN org that we need to trust. On the other hand, it's not your network! Why do you thin…
Re: Governments spying on Apple, Google users through push notifications
#126Hey other states, can you elect a few more Ron Wydens? He's been doing a ton of the heavy lifting lately. Every time we hear about the intelligence community egregiously violating civil liberties, it's always Wyden.
Re: Governments spying on Apple, Google users through push notifications
#127Earlier quoted context omitted.
It would very much help if you wanted to stop the government hoovering up the content of chat messages sent as push notifications
Encrypted messengers aren’t sending unencrypted push payloads, at least not deliberately. A lot of apps don’t even put much in the push messages themselves at all, they are mainly an indicator to phone home for more information. Consequently no gov has been getting meaningful info from the content of this stuff for many years - it will all be what you can infer from observed patterns, which is a lot.
Re: Governments spying on Apple, Google users through push notifications
#128Earlier quoted context omitted.
"Still bad" strongly underestimates the problem. Metadata often is more important than the data as demonstrated in the above examples.
I disagree. Thieves can't steal my money from my bank with metadata.
Re: Governments spying on Apple, Google users through push notifications
#129Earlier quoted context omitted.
> I wonder if this is a case of American intelligence outsourcing the surveillance of American citizens to foreign intelligence. If that is indeed the case, I’d expect a quid pro quo. Yet it is the US government who revealed it: "In a letter to the Department of Justice, Senator Ron Wyden said foreign officials were demanding the data from Alphabet's (GOOGL.O) Google and Apple (AAPL.O). Although details were sparse,…
> Yet it is the US government who revealed it Less "the government" and more "a member of government", the same member who has revealed and demanded accountability when discovering domestic government overreach. We should choose our congress critters carefully.
Agreed 100% and sadly, quite rare. I'm not going to start naming names, because that would devolve this into a political conversation about the parties. That isn't this. I suspect most people know who the criminals are. Now to see if they care.
Re: Governments spying on Apple, Google users through push notifications
#130Earlier quoted context omitted.
The timing would still give you away - with a privileged network position you can tell that a user sent a message to an messaging service, and that some set of users got notifications from that messaging service moments later. Observe that enough times and you'll have good confidence in the members of a group. If you're trying to hide from that type of attack you need to send a fixed rate stream of messages (most of…
If notification is malformed or erroneous it should be invisible, shouldn't it?
However, I was actually wrong more generally because Apple does have push notification type for this, Background Updates[1] are permitted to run invisibly. They say not to try sending more than 2-3 per hour, and that "the system may throttle the delivery of background notifications if the total number becomes excessive" - which sounds like you're permitted some unspecified small number between app launches.
These notifications seem to only be able to send a single boolean flag, so it doesn't seem like an awfully viable way of implementing a fixed rate message system (especially because you'd also want to be sending messages out on that same fixed rate to frustrate analysis)
1: https://developer.apple.com/documentation/usernotifications/...