Governments spying on Apple, Google users through push notifications -US senator

Re:Governments spying on Apple, Google users through push no... by michh on Wednesday December 06, 2023 @11:32AM (#38546096)

for my understanding, you need that entitlement so you can send an encrypted invisible notification which you can then decrypt locally in your app and push out again as a local notification that doesn't go over the network (i.e. not use apns)? Or is doing this kind of stuff just weirdly tied to that specific entitlement?

[ Parent | on HN ]

Re:Governments spying on Apple, Google users through push no... by robbiet480 on Wednesday December 06, 2023 @11:40AM (#38546201)

Correct, we need to be able to filter to properly unencrypt notifications and pass them on as a local notification.

[ Parent | on HN ]

Re:Governments spying on Apple, Google users through push no... by xenadu02 on Wednesday December 06, 2023 @06:21PM (#38550842)

No, you do not need this just for decryption. This entitlement is only required if you want your Notification Extension to be able to silently eat the notification. Normally an extension must transform the notification then the system presents it to the user.

APNS is not a "let my server wake up my app in the background whenever and however often I like" mechanism.

Defer handling other things until either your extension or your app would have run anyway and do them at that time.

[ Parent | on HN ]

Re:Governments spying on Apple, Google users through push no... by smashed on Wednesday December 06, 2023 @08:25PM (#38551735)

When you're transforming the push notification, can you make an https request?

Send a meaningless random ID, then do a get request to your API to get the actual content, then present it to the user.

Only a meaningless ID will transit through google/apple servers.

Honest question. I'm sure many thought about it before.

[ Parent | on HN ]

Re:Governments spying on Apple, Google users through push no... by Klonoar on Wednesday December 06, 2023 @10:21PM (#38552456)

You can do quite a few things - it’s not a widely written about area of development (relatively speaking) but you have a surprising amount of stuff at your fingertips.

I built a finance app a few years ago that would take market data via a push notification, and then the transform extension would render it to a chart image and attach the image to the notification to avoid generating them server side.

[ Parent | on HN ]

Re:Governments spying on Apple, Google users through push no... by toomuchtodo on Wednesday December 06, 2023 @10:30PM (#38552511)

> You can do quite a few things - it’s not a widely written about area of development (relatively speaking) but you have a surprising amount of stuff at your fingertips.

I would pay to commission a blog post on the topic if you’re willing to write it.

[ Parent | on HN ]

Re:Governments spying on Apple, Google users through push no... by Klonoar on Friday December 08, 2023 @09:18PM (#38577758)

I unfortunately don't have time to do that, but I believe the Guardian did a similar trick some years ago for election result updates. Try googling around for that, it's very interesting reading.

[ Parent | on HN ]