Good time to switch to an open source degoogled android ROM and set up your own push notification server.
Until people stop giving up their freedom to these companies by agreeing to legal documents they don’t even read, it’s only going to get worse.
Lol you’re dreaming if you think even 0.1% of people will be interested in setting up their own server.
It’s not so difficult actually. If you already use Conversations from F-Droid you can use your XMPP address to receive push notifications for example.
Let me just tell my dad next time he can find the Skype icon on his taskbar so I can call him.
Most “standard” messaging apps (that includes signal, telegram) use the “OS provided” push service. On Android, they use firebase cloud messaging, a component of google play services.
Degoogled Android means not having any notifications, unless the app supports UnifiedPush, runs in the background 24/7 (which drains battery), or runs in the background occasionally (which delays notifications).
If the app runs in the background occasionaly, you can “burden” the people on the other side by being slow to respond.
They’re also dreaming if they think doing these things doesn’t just make them stand out, and provides them any real protection from state actors.
The number one rule of tradecraft is to blend in. I promise that you haven’t thought of some way of using an always connected smartphone that the NSA hasn’t considered. They are probably the ones making your degoogled ROMs.
This is hubris, plain and simple. If your goal is to hide from state actors then the best way of doing that is to be uninteresting statistical noise.
That’s why I bothered to set up a nixOS config to deploy a docker cluster… I’m planning to give my friends and family a USB that connects to a private shared VPN, so all I have to do is walk them through booting from it
We all get a way to back up stuff with redundancy, and I’ll throw up a Jellyfish server, maybe set up some llm assistants to scrape the web for interesting news and put it in a Lemmy instance or something. These are all things I want for myself, and I am willing to configure it exactly once… At that point, might a well let people I trust join the cluster.
Even my technical family used to scoff and ask why bother… This last week when my sister called and asked what I was up to, instead of explaining that it’s more than just targeted ads, I asked if they noticed that everything sucks way more lately.
They never used to listen before… I think that’s changing. I think it’s time to build out alternatives
I agree those are good things to do.
But… Blaming people who are being fucked over by forces generally outside their control is not really going to help their or our situation. Expecting or demanding “people” to just change is also not realistic. Even if they wanted to, time, effort, energy, knowledge, skills, and attention are all finite. This is just one important issue or source of exploitation among a sea of others.
But… Blaming people who are being fucked over by forces generally outside their control is not really going to help their or our situation.
The whole premise of the comment is that it’s not outside of their control, they just chose not to be responsible for the agreements they make. If you have any better suggestions than blaming those responsible for the situation I’m willing to listen and maybe even change my mind.
Expecting or demanding “people” to just change is also not realistic. Even if they wanted to, time, effort, energy, knowledge, skills, and attention are all finite.
Is it more unrealistic than “we” deciding to change and find a better path forward than surrendering our digital lives to strangers? I’m able to self-host my own push server. I wasn’t born with that knowledge. I had to invest time, effort and energy to gain the knowledge and skills. If I can, so can others. I am not an extraordinary smart person.
Still, long before one starts to self-host entire platforms like NTFY or Nextcloud Push, there’s a ton of free to use services ran by idealists rather than capitalists. Or payed options with good terms. There’s so much between just not caring and being ones own sysadmin that I don’t think “don’t have the time” is a valid excuse anymore. It’s not just push messages, it’s everything - as you point out:
This is just one important issue or source of exploitation among a sea of others.
Sure. And most people I offered a free Nextcloud account to said the same. And Mastodon/Friendica-accounts. And so on. It’s like a technological mass depression, we can’t do everything we need to so there’s no point doing anything at all.
And today I’m running a custom ROM and no push services from Big Data while they’re literally getting robbed of their phonebooks by Meta.
The whole premise of the comment is that it’s not outside of their control, they just chose not to be responsible for the agreements they make.
“If you haven’t chosen to be a subsistence farmer, every problem with Big Agriculture is entirely your fault.”
Is there a self-hosted alternative to SMS push? That’s my main push notification, I can’t think of another “service” I use on my phone. I’m an edge case though, already degoogled and don’t let much push to me. SMS is a necessity for work and personal.
Hell, SMS is clear text, no need to get the notifications.
This issue is about the notifications for (supposedly) encrypted chat apps hat use Apples notification service (and Google’s) such as iMessage, Telegram, WhatsApp, etc.
How do those governments have access to this data? Is it not TLS encrypted?
The article states that Apple recommends not putting any sensitive data in the payloads as well as encrypting the payloads
This sounds a lot like a scenario where Apple informs that a mechanism used for standard mobile communication is being survived by governments not necessarily a scenario where something Apple or google are doing is inherently surveillance.
Here it seems like the surveillance is occurring at the 3rd parties who send the push notifications.
Apple would be able (and perhaps required?) to provide the decrypted data. TLS is not end-to-end encryption; it’s just server-to-client. It’s useful to prevent MITM wiretapping but it is NOT useful to prevent server-side spying.
The article quotes Apple as saying they can update their transparency report now that this is public. Doesn’t look like they have data for 2023 yet at https://www.apple.com/legal/transparency/
I’d think Apple could make push notification content end-to-end encrypted if they so desired, but I don’t know how they could avoid having access to the vendor and user at minimum for the sake of validation and delivery.
not sure how it works on iOS, but at least on Android Signal has been taking some extra measures to avoid that. the message contents aren’t delivered over GCM, just the ping that there’s a new incoming message, which is then downloaded by Signal separately.
That’s kind of how iMessage works, the Apple equivalent to GCM (Google Cloud Messaging) is called APN (or is it ANP? I always forget), and it sends a notification to the phone which then retrieves the message.
Be interesting to hear the perspective of the developers of Bubble Mini, since they just reverse-engineering iMessage.
The data is said to have been used to attempt to tie anonymous users of messaging apps to specific Apple or Google accounts.
So it’s not about the notifications or even necessarily the data the app handles; just that there’s an apple ID or google ID they’re pinging to see who it is.
Today’s lesson is: Never use your apple ID or (ugh) google ID for anything important. If you can not use either for anything, great, but we all know we’re not international super spies and sometimes you just want to play a card game or something. Still. If someone’s unaware that smartphones are tracking devices they should probably know that now.
I’m amazed that Apple was prohibited from saying anything until now.
Just because we’re not James Bond today, doesn’t mean we won’t be a person of interest tomorrow.
That’s what’s so dangerous, especially for stuff that’s just collected for no particular reason. Look at the man who was arrested for a crime simply because he biked through the area during the right time, and his Google location history showed up in a search.
Look at the man who texted photos of his son’s genitalia to said son’s doctor and got his entire Google account banned when his phone automatically synced them to Gdrive and the algorithm decided he was a pedophile
I don’t know if that’s a great example tbh. How does Google know it’s a medically necessary picture of a child’s genitals? Just don’t do that. Don’t send anyone pictures of your kid’s junk. Or anyone’s junk for that matter, except maybe your own if you really want to. Certainly not over unencrypted channels. That seems very obvious to me. If your kid’s dick is falling off, go to the ER
Sounds just like the idea that governments can retrieve metadata from phone calls without much hassle.
I’m not sure there is much you could do to get around this on iOS besides disabling push notifications in your app.
