Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Governments spying on Apple, Google users through push notifications

reuters.com

Post reply on HN
Print view View original

311–320 of 649 posts

Re: Governments spying on Apple, Google users through push notifications

#311

Post by forward1 »

JohnFen wrote: post #213
ddalex wrote: post #205

Earlier quoted context omitted.

Not sure why down voted. Even the quoted article states: > Border Patrol, nevertheless, cannot pull anyone over without “reasonable suspicion” of an immigration violation or crime (reasonable suspicion is more than just a “hunch”). Similarly, Border Patrol cannot search vehicles in the 100-mile zone without a warrant or “probable cause” (a reasonable belief, based on the circumstances, that an immigration violation o…

In practice, "reasonable suspicion" means "whenever they want."

The potential to abuse power is not a reason to disavow it.

Re: Governments spying on Apple, Google users through push notifications

#312

Post by sonicanatidae »

criddell wrote: post #194
sonicanatidae wrote: post #124

Earlier quoted context omitted.

>What is the point of transparency reports if they don't include major vectors of government surveillance? The feels.

It's more than that, IMHO. I think companies publishing whatever they can is a good thing. We would be worse off if they took the attitude of if we can't publish everything we might as well publish nothing .

I'm infinitely more cynical about corporations. For me, it's always about what they can do to mitigate any and all possible blame, regardless of circumstance, context, and the world itself. Always.

Re: Governments spying on Apple, Google users through push notifications

#313

Post by jwnin »

chatmasta wrote: post #73

This, to me, is the more disturbing part of the article: > In this case, the federal government prohibited us from sharing any information," the company said in a statement. "Now that this method has become public we are updating our transparency reporting to detail these kinds of requests. What is the point of transparency reports if they don't include major vectors of government surveillance? IMO such gag orders sh…

This is why warrant canaries can be useful in privacy policies, at least for smaller/startup companies. The apple/google/microsoft/amazon/metas of the world would have had to remove the canary long ago, though.

Re: Governments spying on Apple, Google users through push notifications

#314

Post by acdha »

chatmasta wrote: post #259
acdha wrote: post #169

Earlier quoted context omitted.

That’s usually untrue - for example, if I’m on Comcast but I use Firefox, my DoH requests go instead to Cloudflare who don’t log IPs – but also the larger point is that DNS isn’t complete enough: sometimes it’s unique companies but a lot of the time it’s just a shared endpoint. Push notifications don’t have that problem and happen every time, not just when a cache expires.

Cloudflare is one of the "major companies" I was alluding to. It's still an issue of centralized authorities that are accountable to governments. But I do trust Cloudflare more than my ISP or Apple, and in fact I route much of my traffic through them so I hope I'm right in giving them my trust.

It’s also a question of what information is available. In the United States, for example, it’s generally seemed to be the case that they can compel release of existing data but not changing systems to record new data or remove encryption. That’s not the case in every country, of course.

Re: Governments spying on Apple, Google users through push notifications

#316

Post by yohannparis »

heywoodlh wrote: post #262

One question I have as someone who tries to maintain (some) data sovereignty: is there any way as an end-user to circumvent/mitigate this kind of surveillance — aside from abandoning iOS and Android completely?

Disable notifications on all applications you do not want to be tracked via metadata.

Re: Governments spying on Apple, Google users through push notifications

#317

Post by michh »

robbiet480 wrote: post #306

We at the Home Assistant Companion for iOS team have been wanting to implement end to end encryption for our push notifications for a while now but Apple has denied our request for the com.apple.developer.usernotifications.filtering [0] entitlement multiple times. Wondering if with today's news we could apply again and get it. For context, we are sending ~35 million push notifications per month on iOS and ~67 million…

for my understanding, you need that entitlement so you can send an encrypted invisible notification which you can then decrypt locally in your app and push out again as a local notification that doesn't go over the network (i.e. not use apns)? Or is doing this kind of stuff just weirdly tied to that specific entitlement?

Re: Governments spying on Apple, Google users through push notifications

#318

Post by forward1 »

jeroenhd wrote: post #294
heywoodlh wrote: post #262

One question I have as someone who tries to maintain (some) data sovereignty: is there any way as an end-user to circumvent/mitigate this kind of surveillance — aside from abandoning iOS and Android completely?

Google-free Android will allow you (force you) to use alternative push servers. That could be your own server (using something like Unified Push) or querying your apps' servers directly. This comes at the cost of battery life, sometimes significantly so, but it does decentralise the notification system. Of course, your data will still be in the hands of app vendors unless you choose your apps wisely. You should also…

Parent is asking about government surveillance.

You're suggesting a deviation from the norm (99.99% of users) by installing a custom operating system (which they will now also be on the hook to secure and update regularly) by developers with nothing to lose.

This will greatly increase scrutiny on you, or colloquially speaking definitely put you on a watch list, the opposite of what is allegedly desired. Rather, accept the plain fact electronic communications are subject to government surveillance and adjust your threat model accordingly. Don't try to fight the bear with a flyswatter.

Re: Governments spying on Apple, Google users through push notifications

#319

Post by asow92 »

buryat wrote: post #299
asow92 wrote: post #282

Apps like https://www.joustip.com/ offer e2e encrypted push notifications.

how do they guarantee that everything is protected and they don’t share data with someone?

How would you want that qualified exactly?

Re: Governments spying on Apple, Google users through push notifications

#320

Post by gosub100 »

jwnin wrote: post #313
chatmasta wrote: post #73

This, to me, is the more disturbing part of the article: > In this case, the federal government prohibited us from sharing any information," the company said in a statement. "Now that this method has become public we are updating our transparency reporting to detail these kinds of requests. What is the point of transparency reports if they don't include major vectors of government surveillance? IMO such gag orders sh…

This is why warrant canaries can be useful in privacy policies, at least for smaller/startup companies. The apple/google/microsoft/amazon/metas of the world would have had to remove the canary long ago, though.

and they're trivial to DDoS
Post reply on HN