Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Governments spying on Apple, Google users through push notifications

reuters.com

Post reply on HN
Print view View original

361–370 of 649 posts

Re: Governments spying on Apple, Google users through push notifications

#361

Post by pphysch »

Nifty3929 wrote: post #310
TheRealDunkirk wrote: post #303

It's crazy to me that so much effort is being expended pretending that companies and the government are doing anything in the name of privacy, when we have all the proof by Assange and Snowden that they're doing realtime surveillance of ALL communications, 24x7 -- no matter what any laws say -- and we don't even talk about it any more. What's the point of any of this? All we can do is assume that our every position,…

I think where we go wrong is to allow the conversation to revolve around what evil corporations are doing with our information, rather than what the evil government is doing with it. I believe the risk to our freedom is much greater from the latter. Of course governments can extract the information from corporations that have it, but let's keep the spotlight on the government itself, and use THAT as a reason to give…

This is such a strange position for me.

Do we not agree that corporate America and other special interest groups essentially control Washington via lobbying and corruption?

Do we not agree that a US citizen has (nominally) more leverage over their government than over an unaccountable private collective?

I mean, we are half a century deep into this Reaganite "your government is your enemy" experiment.

Re: Governments spying on Apple, Google users through push notifications

#362

Post by riversflow »

Nifty3929 wrote: post #310
TheRealDunkirk wrote: post #303

It's crazy to me that so much effort is being expended pretending that companies and the government are doing anything in the name of privacy, when we have all the proof by Assange and Snowden that they're doing realtime surveillance of ALL communications, 24x7 -- no matter what any laws say -- and we don't even talk about it any more. What's the point of any of this? All we can do is assume that our every position,…

I think where we go wrong is to allow the conversation to revolve around what evil corporations are doing with our information, rather than what the evil government is doing with it. I believe the risk to our freedom is much greater from the latter. Of course governments can extract the information from corporations that have it, but let's keep the spotlight on the government itself, and use THAT as a reason to give…

> I believe the risk to our freedom is much greater from the latter.

I’ll take power being consolidated in a democratically elected government over a privately controlled corporation any day of the week.

Let’s put the spotlight on the stuff that isn’t democratically controlled, and subject to much more limited oversight.

Re: Governments spying on Apple, Google users through push notifications

#363

Post by daveoc64 »

Klonoar wrote: post #341
angio wrote: post #32

Earlier quoted context omitted.

They mention metadata in the article. Imagine sending a message to a Signal account at time X, then asking Apple a list of all users that received a Signal notification at that specific time.

Unless I’m mistaken - and I might be or it may have changed - Signal notifications on iOS just tell the app “hey, something happened, call the service and check for updates”. I.e, the push notification itself contains little to nothing in terms of data/metadata. You can also of course decrypt a notification by shipping an extension to do so, and maybe Signal does - it’s been awhile since I poked around it. I’d just b…

What you've said is correct, but it doesn't stop the attack vector described.

If the question to Apple or Google is "who received a notification from Signal at 17:15 UTC?" then even if the notification is “hey, something happened, call the service and check for updates”, you've got your answer.

Re: Governments spying on Apple, Google users through push notifications

#364

Post by digging »

mitchitized wrote: post #348
Nifty3929 wrote: post #310

Earlier quoted context omitted.

I think where we go wrong is to allow the conversation to revolve around what evil corporations are doing with our information, rather than what the evil government is doing with it. I believe the risk to our freedom is much greater from the latter. Of course governments can extract the information from corporations that have it, but let's keep the spotlight on the government itself, and use THAT as a reason to give…

Wouldn't the exact opposite focus have a better effect? Going after the "evil corporations" would mean nobody was collecting the data in the first place, which would also take away the "evil government" as they have nobody to buy that data from. Right now they just write fat checks to Google, Apple, Amazon and the telcos and badda bing, badda boom it's done.

I suppose if government orgs weren't allowed to buy that data, the value might drop. Significantly? Unclear.

Re: Governments spying on Apple, Google users through push notifications

#365

Post by Klonoar »

multiplegeorges wrote: post #100
notaustinpowers wrote: post #34

What sort of metadata or information can be gathered from a push notification from an app like iMessage? I know a timestamp is there and most likely the sender's phone number. But is there some sort of sensitive info that these governments are trying to glean? Or is it more so they can build info maps and communication maps on targets?

Compromise a single phone in a target group, send a message to an anonymous chat, and you now know every other member of the group. Apple needs to know your Apple ID to send you an APNS payload. Now your anonymous chat profile is tied to your real Apple ID. Busted.

This is not necessarily true. You’re assuming that all the info is in push notifications themselves.

E.g: if I get a push notification that is simply “you have a new event, poll the server”, and then I poll the server for (encrypted) batch updates, where exactly do you see the leak that ties an anonymous profile to an Apple ID? Given a large enough service, that same generic batch update endpoint would be getting hammered and I have to think it would effectively be camouflaged to a degree.

Granted, not every app is going to use this design - but if or when done properly I don’t see that much of an issue here.

(I am open to being wrong, mind you)

Re: Governments spying on Apple, Google users through push notifications

#366

Post by codys »

eggy wrote: post #96

Given a lot of journalists and activists use encrypted communications to be able to do their job without being unduly or unjustly persecuted (yes, the bad guys use them too!), and 12 US State Attorney Generals just signed a letter and delivered it to the major news agencies (NYT, CNN, Reuters, AP, etc.) that warns of any "support to terrorist organizations" and specifically points out Hamas, but is not very clear on…

To add a bit more context here, the "12 US State Attorney Generals" here are 14 Republican US State Attorneys general.

their letter: https://content.govdelivery.com/attachments/IACIO/2023/12/04...

Re: Governments spying on Apple, Google users through push notifications

#367

Post by colordrops »

riversflow wrote: post #362
Nifty3929 wrote: post #310

Earlier quoted context omitted.

I think where we go wrong is to allow the conversation to revolve around what evil corporations are doing with our information, rather than what the evil government is doing with it. I believe the risk to our freedom is much greater from the latter. Of course governments can extract the information from corporations that have it, but let's keep the spotlight on the government itself, and use THAT as a reason to give…

> I believe the risk to our freedom is much greater from the latter. I’ll take power being consolidated in a democratically elected government over a privately controlled corporation any day of the week. Let’s put the spotlight on the stuff that isn’t democratically controlled, and subject to much more limited oversight.

The US government isn't really democratically controlled, which is obvious to anyone paying attention, and this Princeton paper proves it:

https://www.princeton.edu/~mgilens/idr.pdf

Re: Governments spying on Apple, Google users through push notifications

#368

Post by colordrops »

pphysch wrote: post #361
Nifty3929 wrote: post #310

Earlier quoted context omitted.

I think where we go wrong is to allow the conversation to revolve around what evil corporations are doing with our information, rather than what the evil government is doing with it. I believe the risk to our freedom is much greater from the latter. Of course governments can extract the information from corporations that have it, but let's keep the spotlight on the government itself, and use THAT as a reason to give…

This is such a strange position for me. Do we not agree that corporate America and other special interest groups essentially control Washington via lobbying and corruption? Do we not agree that a US citizen has (nominally) more leverage over their government than over an unaccountable private collective? I mean, we are half a century deep into this Reaganite "your government is your enemy" experiment.

https://www.princeton.edu/~mgilens/idr.pdf

Re: Governments spying on Apple, Google users through push notifications

#369

Post by PrimeMcFly »

forward1 wrote: post #318
jeroenhd wrote: post #294

Earlier quoted context omitted.

Google-free Android will allow you (force you) to use alternative push servers. That could be your own server (using something like Unified Push) or querying your apps' servers directly. This comes at the cost of battery life, sometimes significantly so, but it does decentralise the notification system. Of course, your data will still be in the hands of app vendors unless you choose your apps wisely. You should also…

Parent is asking about government surveillance. You're suggesting a deviation from the norm (99.99% of users) by installing a custom operating system (which they will now also be on the hook to secure and update regularly) by developers with nothing to lose. This will greatly increase scrutiny on you, or colloquially speaking definitely put you on a watch list, the opposite of what is allegedly desired. Rather, accep…

They won't get put on a list, it will just be assumed they don't do anything via a smartphone.

Re: Governments spying on Apple, Google users through push notifications

#370

Post by lostNFound »

unethical_ban wrote: post #356
2OEH8eoCRo0 wrote: post #132

Earlier quoted context omitted.

Here is a better pro-tip- don't do criminal things.

I bet you've committed at least a ticketable offense in the past 48 hours, unless you are a true hermit. Our laws were not designed for a society with perfect surveillance.

This is quite the proposition. You think that the average person commits a legal offense at least every 2 days?

What examples are you proposing? If you count speeding, sure I guess.

Post reply on HN