Shouldn’t it be impossible for them to even be able to hand over your notifications in the first damn place.
There’s no reason I can think off that they should even have this info.
it’s up to individual app developers to encrypt the data in their push notifications. as for the data about the notifications (the metadata stored on Apple’s/Google’s servers), that could end up being potentially useless if it were just a block of timestamped and encrypted data sitting on Apple’s or Google’s servers. Presently, that data often also includes the full notification contents, unencrypted.
But when those companies get a court order/subpoena, they have no choice but to cooperate.
edit: for clarity
The metadata is actually quite important.
Sure, chances are it’s a “pending WhatsApp message” notification, but not the actual contents of the message.
However, with enough metadata and by surveying traffic from WhatsApp data centers, someone could see User A accessed WhatsApps service, which generated a WhatsApp notification for User B.
That might just be a coincidence, but with enough data and time, the probability that User A is talking to User B can be increased.
If it also shows that Users C, D and E also get notifications at the same time, it is likely that all those users are in a group chat together.
It’s called a timing attack.
And perhaps it isn’t enough evidence to stand up in court, it can help build the profile of the users, and guide investigations to other possible accomplices.I realize that sometimes metadata can be aggregated in nefarious ways. sometimes, however, it’s useless. currently, however, it contains all of the unencrypted contents of the notification itself, not just the metadata, and my point is that’s it’s better to take the step of encrypting the notifications themselves to at least protect that data.
But why would a copy of the notification history exist outside of the phone itself? I can’t think of a reason why notifications should be collected at all.
Imagine you have 20 apps that can send receive notifications from remote (messaging apps, offers, updates…). That would require each app to be active in the background and pulling updates. That’s a massive battery drain.
Instead, the apps send the notifications to Apple/Google, and the OS checks for all of the apps. The apps don’t need to be awake (the OS could show the notification or wake the app) and there’s only one service checking for the ml notifications.
It’s a massive oversimplifying and probably I made some mistakes, but that’s my understanding. Hopefully somebody can correct me.
A good step, but seems like spilled milk after the previous news.
deleted
How do people read giz? I block the ads, but still there’s a sticky video overlay, and “related” links everywhere… unreadable
I’m using pihole for DNS and ublock for Firefox on android and I get no adverts.
Saaaame and the stupid video still follows me.
Lotta white space.
I can see why these web sites are dying.
Gawker media was sued into the ground by a billionaire quite a few years back for posting an article about him being gay and now it just exists to make as much money from adverts as possible until it dies.
It used to be quite a good group of sites for tech news and such.
Gawker was godawful and deserved to be killed. They had a service called (not kidding) gawker stalker which gave live updates on celebrities locations, an actual stalkers wet dream
Would it be possible for Apple to just encrypt this data or, not keep this data? Then there would be nothing to give law enforcement or government. (Forgive my ignorance, I have no idea how all this works.)
The developer of the app sends the push notification through Apple’s service. Developers have always been able to encrypt it, at which point it can be decrypted only by their app, but not all developers do this. There’s also still limited metadata about the fact that a notification was sent, even if the contents are encrypted.
deleted
