Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Governments spying on Apple, Google users through push notifications

reuters.com

Post reply on HN
Print view View original

201–210 of 649 posts

Re: Governments spying on Apple, Google users through push notifications

#201

Post by AshamedCaptain »

garblegarble wrote: post #40
matthewdgreen wrote: post #8

Some issues could be prevented if push messages added end-to-end encryption by default, something that shouldn’t be particularly hard to use if it was built into the dev tooling. Instead, developer recommendations like this one [0] suggest that you should put content into your push messages and optionally use a separate library to encrypt them. Clearly developers aren’t doing this, hence the opportunity for surveilla…

The timing would still give you away - with a privileged network position you can tell that a user sent a message to an messaging service, and that some set of users got notifications from that messaging service moments later. Observe that enough times and you'll have good confidence in the members of a group. If you're trying to hide from that type of attack you need to send a fixed rate stream of messages (most of…

In fact, at least on Android, the contents of most push notifications are not the actual messages to be displayed to the user, but just empty notifications letting the app know it must poll for something on the server or some other activity which may result in a notification.

It's all about the timing (and meta-data like which app), not about the contents.

Re: Governments spying on Apple, Google users through push notifications

#202

Post by Clubber »

gowld wrote: post #158
Clubber wrote: post #138

Earlier quoted context omitted.

I'm not sure why you're being downvoted. That's been a common charge against our vast unelected bureaucracy, most of whom hold qualified immunity. We're trillions of dollars in debt, maybe it's time to peel some of it back a little.

Downvotes are possibly because the unelected bureaucrats with guns are overseen by the elected Executive and Legislature.

Are they though? How about the FDA getting most of its funding by the companies they are supposed to regulate? It's comforting to just trust that bureaucracies are doing what's good for the country, but also naive.

https://aspe.hhs.gov/sites/default/files/documents/e4a791060...

How about the NSA spying on congress?

https://www.theguardian.com/world/2014/jan/04/nsa-spying-ber...

How about the ATF making up laws?

https://nclalegal.org/2019/09/atf-admits-it-lacked-authority...

The only teeth congress has with these bureaucracies is the power of the purse.

Re: Governments spying on Apple, Google users through push notifications

#203

Post by curation »

pc86 wrote: post #199
titzer wrote: post #155

Earlier quoted context omitted.

> But gagging a company from disclosing untargeted or semi-targeted surveillance, especially if it involves American citizens, seems like it should be unconstitutional on free speech grounds. I see you have not read the Patriot Act, an Orwellian double-speak of a title if there ever was one.

The first "paper" I ever wrote was an anti-USA PATRIOT Act paper for a scholarship competition in 2003 when I was 17 where I was awarded $1,000. Literally the only thing I remember is what the acronym USA PATRIOT stands for. Uniting and Strengthening American by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism. It really is one of the best double-speak bill titles ever.

cool!

Re: Governments spying on Apple, Google users through push notifications

#204

Post by forward1 »

lolinder wrote: post #189
forward1 wrote: post #156

Earlier quoted context omitted.

This is a common misconception. The 100 mile radius does not waive 4th Amendment protection. A reasonable suspicion of immigration law violation is still required to detain, search and ultimately arrest individuals. To wit: please name a single instance of someone having their rights abused by this so-called "zone".

This article [0] lists several cases of warrantless searches, one of which was in Florida. Apparently that 100 mile radius isn't just from the Canadian border or the Mexican border, it's also 100 miles from any coast, which means that 2/3 of the population lives within that radius. As far as "reasonable suspicion" goes, I'm increasingly unwilling to support the right of law enforcement to independently, without overs…

Where is the "warrantless search"?

> [CBP officers] demanded proof of citizenship from the passengers

> CBP officers boarded a bus in Bangor, Maine

None of those are searches, they are temporary detentions with strong legal basis and case law going back to Terry. To wit:

> most people have no idea that they can refuse to be searched at a roadblock or bus boarding

Ignorance of the law != warrantless searches. Arm yourself with knowledge, just as the Founding Fathers intended.

Re: Governments spying on Apple, Google users through push notifications

#205

Post by ddalex »

forward1 wrote: post #156
iAMkenough wrote: post #90

Earlier quoted context omitted.

Given the US has a 4th Amendment-free zone within 100 miles of all national borders in the name of national security, I expect the same justification and level of oversight here. https://www.aclu.org/documents/constitution-100-mile-border-...

This is a common misconception. The 100 mile radius does not waive 4th Amendment protection. A reasonable suspicion of immigration law violation is still required to detain, search and ultimately arrest individuals. To wit: please name a single instance of someone having their rights abused by this so-called "zone".

Not sure why down voted. Even the quoted article states:

> Border Patrol, nevertheless, cannot pull anyone over without “reasonable suspicion” of an immigration violation or crime (reasonable suspicion is more than just a “hunch”). Similarly, Border Patrol cannot search vehicles in the 100-mile zone without a warrant or “probable cause” (a reasonable belief, based on the circumstances, that an immigration violation or crime has likely occurred).

Re: Governments spying on Apple, Google users through push notifications

#206

Post by ericmay »

toyg wrote: post #193
ericmay wrote: post #175

Earlier quoted context omitted.

Or (insert country you have a political agenda against) to (do thing you disagree with) for the purposes of (pushing your own political agenda).

More like "or (insert country that shouldn't be doing something according to its own laws) to (do something against its own laws) for the purposes of (someone's profit)".

Sure and that applies (at least) to the EU (and friends), US, UK, China, Russia, Japan, South Korea, Singapore, Australia, New Zealand, Saudi Arabia, Israel, Turkey, India, etc.

Re: Governments spying on Apple, Google users through push notifications

#207

Post by danaris »

garblegarble wrote: post #40
matthewdgreen wrote: post #8

Some issues could be prevented if push messages added end-to-end encryption by default, something that shouldn’t be particularly hard to use if it was built into the dev tooling. Instead, developer recommendations like this one [0] suggest that you should put content into your push messages and optionally use a separate library to encrypt them. Clearly developers aren’t doing this, hence the opportunity for surveilla…

The timing would still give you away - with a privileged network position you can tell that a user sent a message to an messaging service, and that some set of users got notifications from that messaging service moments later. Observe that enough times and you'll have good confidence in the members of a group. If you're trying to hide from that type of attack you need to send a fixed rate stream of messages (most of…

What you're talking about is achieving perfect privacy/security.

Even just E2EE on the notifications themselves would be an improvement over the current situation. It would make certain categories of data unavailable to eavesdroppers. The fact that it would not protect against 100% of all types of data/metadata exfiltration is not sufficient reason to oppose implementing it.

Re: Governments spying on Apple, Google users through push notifications

#208

Post by fsflover »

beretguy wrote: post #174
xyst wrote: post #150

Would be great to see an example of notification metadata that can supposedly link it to real users. Seems like this is what is being implied: Given: - users with notifications enabled - have X app installed - targeted user(s) reside in USA - targeted users(s) following “foo” on X app When: - issue FISA warrant for all smartphone users that received notifications in regards to “foo” user Then: - able to pull all Appl…

So, don’t have Twitter account and/or app installed and you should be good?

Also, no Signal.

Re: Governments spying on Apple, Google users through push notifications

#209

Post by xyst »

onionisafruit wrote: post #167
xyst wrote: post #150

Would be great to see an example of notification metadata that can supposedly link it to real users. Seems like this is what is being implied: Given: - users with notifications enabled - have X app installed - targeted user(s) reside in USA - targeted users(s) following “foo” on X app When: - issue FISA warrant for all smartphone users that received notifications in regards to “foo” user Then: - able to pull all Appl…

If they use IP to deliver notifications, then the gov can demand they hand over the IP address a notification was delivered to. From there, location isn’t hard.

IP geolocation isn’t exactly the most precise though. 600M+ IPs have a default location to some farm in Kansas [1]

[1] https://www.washingtonpost.com/news/morning-mix/wp/2016/08/1...

Re: Governments spying on Apple, Google users through push notifications

#210

Post by xyst »

beretguy wrote: post #174
xyst wrote: post #150

Would be great to see an example of notification metadata that can supposedly link it to real users. Seems like this is what is being implied: Given: - users with notifications enabled - have X app installed - targeted user(s) reside in USA - targeted users(s) following “foo” on X app When: - issue FISA warrant for all smartphone users that received notifications in regards to “foo” user Then: - able to pull all Appl…

So, don’t have Twitter account and/or app installed and you should be good?

no, need to get rid of your smartphone completely.
Post reply on HN