← Back to context

Comment by bigyabai

5 hours ago

Privacy legislation and infrastructure are both designed to eschew common-sense. It's how the fed gets away installing backdoors in iOS and Android: https://arstechnica.com/tech-policy/2023/12/apple-admits-to-...

3 comments

bigyabai

Reply
nine_k  4 hours ago

Beautiful :-\ But it's not a backdoor on devices, it's eavesdropping push notifications when they pass Google's or Apple's servers.

Corollary: a secure notification should consist of a link with a random number token which opens the real message via an authenticated API on an encrypted channel. Would look a bit weird though. iOS at least has silent notifications for that.

  • GeekyBear  3 hours ago

    No company in the US has any choice when Federal, State, or local officials get a court warrant and want data on your server.

    That's why the surveillance capitalism business model is so dangerous. If you horde user data to make ad sales more profitable, you put your users at risk.

    If app developers want to pass customer data in notifications, the data they are passing should be encrypted so that Apple (or Google) doesn't have access.

    You can't hand over what you can't access.

    As they say in Apples developer docs:

    > Important

    Don’t include customer information or any sensitive data, like a credit card number, in a notification’s payload. If you must include customer information or sensitive data, encrypt it before adding it to the payload.

    You can use a notification service app extension to decrypt the data on the user’s device.

    https://developer.apple.com/documentation/usernotifications/...