Anyone who thinks Apple is private is getting fucked balls deep by marketing at face value.
Apple Confirms Governments Using Push Notifications to Surveil Users
Submitted 11 months ago by DannyMac@lemmy.world to technology@lemmy.world
https://www.macrumors.com/2023/12/06/apple-governments-surveil-push-notifications/
Comments
mojo@lemm.ee 11 months ago
noodlejetski@lemm.ee 11 months ago
not sure how it works on iOS, but at least on Android Signal has been taking some extra measures to avoid that. the message contents aren’t delivered over GCM, just the ping that there’s a new incoming message, which is then downloaded by Signal separately.
BearOfaTime@lemm.ee 11 months ago
That’s kind of how iMessage works, the Apple equivalent to GSM is called APN (or is it ANP? I always forget), and it sends a notification to the phone which then retrieves the message.
Be interesting to hear the perspective of the developers of Bubble Mini, since they just reverse-engineering iMessage.
LainOfTheWired@lemy.lol 11 months ago
Good time to switch to an open source degoogled android ROM and set up your own push notification server.
Until people stop giving up their freedom to these companies by agreeing to legal documents they don’t even read, it’s only going to get worse.
solarvector@lemmy.zip 11 months ago
I agree those are good things to do.
But… Blaming people who are being fucked over by forces generally outside their control is not really going to help their or our situation. Expecting or demanding “people” to just change is also not realistic. Even if they wanted to, time, effort, energy, knowledge, skills, and attention are all finite. This is just one important issue or source of exploitation among a sea of others.
registrert@lemmy.sambands.net 11 months ago
But… Blaming people who are being fucked over by forces generally outside their control is not really going to help their or our situation.
The whole premise of the comment is that it’s not outside of their control, they just chose not to be responsible for the agreements they make. If you have any better suggestions than blaming those responsible for the situation I’m willing to listen and maybe even change my mind.
Expecting or demanding “people” to just change is also not realistic. Even if they wanted to, time, effort, energy, knowledge, skills, and attention are all finite.
Is it more unrealistic than “we” deciding to change and find a better path forward than surrendering our digital lives to strangers? I’m able to self-host my own push server. I wasn’t born with that knowledge. I had to invest time, effort and energy to gain the knowledge and skills. If I can, so can others. I am not an extraordinary smart person.
Still, long before one starts to self-host entire platforms like NTFY or Nextcloud Push, there’s a ton of free to use services ran by idealists rather than capitalists. Or payed options with good terms. There’s so much between just not caring and being ones own sysadmin that I don’t think “don’t have the time” is a valid excuse anymore. It’s not just push messages, it’s everything - as you point out:
This is just one important issue or source of exploitation among a sea of others.
Sure. And most people I offered a free Nextcloud account to said the same. And Mastodon/Friendica-accounts. And so on. It’s like a technological mass depression, we can’t do everything we need to so there’s no point doing anything at all.
And today I’m running a custom ROM and no push services from Big Data while they’re literally getting robbed of their phonebooks by Meta.
iAmTheTot@kbin.social 11 months ago
Lol you're dreaming if you think even 0.1% of people will be interested in setting up their own server.
Socsa@sh.itjust.works 11 months ago
They’re also dreaming if they think doing these things don’t just make them stand out, or provide them real protection from state actors.
The number one rule of tradecraft is to blend in. I promise that you haven’t thought of some way of using an always connected smartphone that the NSA hasn’t considered. They are probably the ones making your degoogled ROMs.
This is hubris, plain and simple. If your goal is to hide from state actors then the best way of doing that is to be uninteresting statistical noise.
theneverfox@pawb.social 11 months ago
That’s why I bothered to set up a nixOS config to deploy a docker cluster… I’m planning to give my friends and family a USB that connects to a private shared VPN, so all I have to do is walk them through booting from it
We all get a way to back up stuff with redundancy, and I’ll throw up a Jellyfish server, maybe set up some llm assistants to scrape the web for interesting news and put it in a Lemmy instance or something. These are all things I want for myself, and I am willing to configure it exactly once… At that point, might a well let people I trust join the cluster.
Even my technical family used to scoff and ask why bother… This last week when my sister called and asked what I was up to, instead of explaining that it’s more than just targeted ads, I asked if they noticed that everything sucks way more lately.
They never used to listen before… I think that’s changing. I think it’s time to build out alternatives
kpw@kbin.social 11 months ago
It's not so difficult actually. If you already use Conversations from F-Droid you can use your XMPP address to receive push notifications for example.
ImTryingLemmy@lemmy.world 11 months ago
Is there a self-hosted alternative to SMS push? That’s my main push notification, I can’t think of another “service” I use on my phone. I’m an edge case though, already degoogled and don’t let much push to me. SMS is a necessity for work and personal.
BearOfaTime@lemm.ee 11 months ago
Hell, SMS is clear text, no need to get the notifications.
This issue is about the notifications for (supposedly) encrypted chat apps hat use Apples notification service (and Google’s) such as iMessage, Telegram, WhatsApp, etc.
kpw@kbin.social 11 months ago
How do those governments have access to this data? Is it not TLS encrypted?
prettybunnys@sh.itjust.works 11 months ago
The article states that Apple recommends not putting any sensitive data in the payloads as well as encrypting the payloads
This sounds a lot like a scenario where Apple informs that a mechanism used for standard mobile communication is being survived by governments not necessarily a scenario where something Apple or google are doing is inherently surveillance.
Here it seems like the surveillance is occurring at the 3rd parties who send the push notifications.
GenderNeutralBro@lemmy.sdf.org 11 months ago
Apple would be able (and perhaps required?) to provide the decrypted data. TLS is not end-to-end encryption; it’s just server-to-client. It’s useful to prevent MITM wiretapping but it is NOT useful to prevent server-side spying.
The article quotes Apple as saying they can update their transparency report now that this is public. Doesn’t look like they have data for 2023 yet at www.apple.com/legal/transparency/
ImTryingLemmy@lemmy.world 11 months ago
To turn that question around, what incentive do the corporations have to encrypt that data? Whole bunch easier to just not care.
Brkdncr@sh.itjust.works 11 months ago
Sounds just like the idea that governments can retrieve metadata from phone calls without much hassle.
I’m not sure there is much you could do to get around this on iOS besides disabling push notifications in your app.
pizza@lemmy.today 11 months ago
homesweethomeMrL@lemmy.world 11 months ago
So it’s not about the notifications or even necessarily the data the app handles; just that there’s an apple ID or google ID they’re pinging to see who it is.
Today’s lesson is: Never use your apple ID or (ugh) google ID for anything important. If you can not use either for anything, great, but we all know we’re not international super spies and sometimes you just want to play a card game or something. Still. If someone’s unaware that smartphones are tracking devices they should probably know that now.
I’m amazed that Apple was prohibited from saying anything until now, actually.
BearOfaTime@lemm.ee 11 months ago
Just because we’re not James Bond today, doesn’t mean we won’t be a person of interest tomorrow.
That’s what’s so dangerous, especially for stuff that’s just collected for no particular reason. Look at the man who was arrested for a crime simply because he biked through the area during the right time, and his Google location history showed up in a search.