23 ms·

Facebook Hit by Apple’s Crackdown on Messaging Feature

267 points by tareqak 7y ago

stelabouras 7y ago
For anyone interested in the technical side of the changes getting introduced in iOS 13 regarding messaging apps, the 707 session 'Advances in App Background Execution' of WWDC 2019 is really helpful: https://developer.apple.com/videos/play/wwdc2019/707/ https://developer.apple.com/videos/play/wwdc2019/707/
dang 7y ago
The submitted URL was https://www.theinformation.com/articles/facebook-hit-by-apples-crackdown-on-messaging-feature https://www.theinformation.com/articles/facebook-hit-by-appl..., which was hard-paywalled. But The Information has been unlocking many of their articles for HN readers. I asked if they would do that for this one and they said yes, so everyone who clicks on the link above should be able to read it now.
- misiti3780 7y ago
  it is still pay-walled for me.
  - SalimoS 7y ago
    Use the link in the submission On another note the reader view on iOS (safari on iPadOS 13 public beta) show only first paragraph
- rwc 7y ago
  Nice, thank you! And thank you to The Information for sharing quality journalism with the HN community.
  - ballmers_peak 7y ago
    No problem!
    - icpmacdo 7y ago
      It seems like a smart win win situation for you. I bet if the WSJ ect. did the same it would drive non trivial growth
  - freehunter 7y ago
    This is pretty nice and I was considering subscribing because of them lifting the paywall but it doesn’t seem like they show the subscription cost until after you’ve given them your email address and created a password? I always assume if you have to ask the price, you can’t afford it. It just seems when you click the “subscribe now” button it would tell you the price of the subscription on the next page.
    - lyctc 7y ago
      The footer's Payment Policy says: Monthly – $39 Annually – $399
      - hermitdev 7y ago
        $400 annually for a news site as a casual user? Fuck no. Edit: I mean, my wife's Netflix sub is on about $14/month, which we would use far more often than a random single website. About 3x a Netflix subscription for a single "news" site? I think they're dramatically overvalualing themselves.
        bashwizard 7y ago
        > About 3x a Netflix subscription for a single "news" site? I think they're dramatically overvalualing themselves. The mainstream media in general have been overvalualing themselves for the past decades.
        7y ago
hart_russell 7y ago
+1 to Apple's track record for user privacy. I do not regret switching from Android to iOS (even if siri is woefully behind the voice assistant game)
- irrational 7y ago
  Also autocomplete. I had a samsung phone running android that was almost omniscient in knowing what I wanted to type or keeping track of what I had just been reading or searching for and giving me suggestions based on that (like if I had been reading about a restaurant and then went to send a text to my wife it would give me prompts about the restaurant, which is exactly what I wanted). iOS autocomplete is woefully subpar in comparison.
  - airstrike 7y ago
    Just install SwiftKey. The native iOS keyboard is absolutely appalling, I don't wish it upon my worst enemy...
    - buzzert 7y ago
      Why is it appalling? Can you be more specific?
      - smallbigfish 7y ago
        That even today many European languages don't even have a basic dictionary. I'm not talking about the "guess the next word" feature. All I want is a dictionary that could suggest a correction to a misspelled word. Use two languages at once? No way! I guess they need to invent a new chip or something. Swipe to type? Hehe. The keyboard in itself is fast and good but it lacks features.
        kalleboo 7y ago
        > Swipe to type? Hehe That's finally coming in iOS 13
kingo55 7y ago
What's with the login wall to read the article? Does every random site need my personal information now?
- randall 7y ago
  It's a paid site.
- jvagner 7y ago
  It’s a pay site. Logging in gives the, a chance to upsell.
  - kingo55 7y ago
    How misleading.
    - Operyl 7y ago
      I mean, given the entire verbiage around the sites login wall, it seemed plenty obvious here.
      - kingo55 7y ago
        Maybe... I don't pay much attention to sales pitches. Just saw 'Read this article for free" and a login button and assumed as much. It'll convert well for them at least.
- pcora 7y ago
  Many sites do that nowadays. The Information seems to be pretty nice, but it's super expensive. At least to me.
- IfOnlyYouKnew 7y ago
  The Information isn't that random (as the name implies). It's an attempt to create a high-value, investigative tech magazine. The paywall is rather strict and it seems to be aimed at the investor class, so I'm not entirely sure how well it's going because I'm not a subscriber, but I believe I've seen a few important stories that originated with them.
_bxg1 7y ago
It's a shame that in today's world we have to choose between platforms that are open-ended and platforms whose software respects its users. But given that choice, I support this outcome.
- medecau 7y ago
  It's very hard to provide both as abusive software (malware) tends to take advantage of the open-endedness of platformas to abuse the users.
  - simonh 7y ago
    It’s worse than that even. Open platforms that are popular get commoditised easily, which squeezes margins for vendors, increasing pressure to monetize by any means possible. The race to the bottom does benefit customers in terms of prices, but there are real costs in terms of the quality and trustworthiness of the products. The cheapest products are most likely to be monetising in shady ways.
therealmarv 7y ago
Essence from this site (from my understanding, read the whole article): WhatsApp is using VoIP iOS features to display end2end encrypted notifications in iOS. This loophole will be closed on iOS13. So either WhatsApp does not display any notifications text on iOS13 with WhatsApp or WhatsApp will remove end2end encryption for the sake of having notifications with text on iOS. This is really alarming for privacy. Seems Apple does not care about privacy and comfort unless it's software from Apple. I just hope WhatsApp will stay strong and never give up on end2end encryption.
- acdha 7y ago
  It has nothing to do with end-to-end encryption: they’re abusing the VoIP feature to stay running in the background, which is trading battery life for better surveillance of your activities. Apple is doing it to _protect_ privacy by closing one of the ways unscrupulous app developers keep trackers running.
  - mantap 7y ago
    The use of voip mode is well established technique for building encrypted messaging apps on iOS, and its unsurprising that whatsapp is built around it, especially when you consider that whatsapp is a voip app. No conspiracy theories are necessary.
    - tareqak 7y ago
      Are Signal and other messaging apps relying on this feature and do they offer VoIP functionality?
      - makomk 7y ago
        As far as I can tell, that's a yes to both: Signal supports VoIP calls, they're definitely using the PushKit VoIP API, and I assume they're using that API for both text notifications and calls since the code doesn't have any reference to the other API they could use.
  - 7y ago
workingpatrick 7y ago
If you don't want to provide your email address I put the article here https://pastebin.com/kKSNFnm8 https://pastebin.com/kKSNFnm8
codeulike 7y ago
I've noticed something sneaky about Facebook on my phone. I refuse to install their apps but I do use Facebook a bit so I use it via the phone Browser (in my case, Chrome on Android). I've noticed that sometimes Facebook shows a fake 'youve got a message' icon to try and trick you into installing their messenger app. To re-produce this behaviour: (this works best if you dont get a lot of facebook messages. Also you need a phone with no facebook apps installed) - On your desktop PC, use facebook to send a message to someone - Then switch to your phone, using facebook in the browser - After about an hour, the little speechbubble message icon at the top will go red, showing you've got a message - If you click on this from a phone browser, it redirects you to install messenger. (normally, phone-browser facebook doesnt do messenger features) - Instead of that, switch on 'request desktop site' (not sure what iOS calls this option) to make your phone display the desktop version of facebook. And then you can (usually) read your messages in the browser - But you will find that there is no new message, and the new message icon will no longer be lit up. I've had this happen five or six times now - supposedly new messages have arrived but when you look there are none. It always happens about an hour after sending a message. I'm pretty convinced its deliberate behaviour on the phone browser version of facebook to get you to install their messenger app.
- andyhmltn 7y ago
  I’ve noticed the same with their notifications. As of right now, I have 1 notification. I will open the menu and see there’s not actually anything there. The badge then goes away. Refresh the page and it’s there again despite not having any notifications
- oceanghost 7y ago
  This is absolutely a dark pattern. I sometimes install the FB app if I need to check something, but NEVER the messaging app. And the FB app will always claim I have 5 or so messages... Which of course is never actually true.
- Forge36 7y ago
  Mine is currently in this state. I want aware it ever stopped.
- 7y ago
yipeedipee 7y ago
Ars just covered it: https://arstechnica.com/gadgets/2019/08/ios-13-privacy-feature-will-force-total-overhaul-for-facebook-apps/ https://arstechnica.com/gadgets/2019/08/ios-13-privacy-featu...
- dang 7y ago
  Normally we'd switch to something like that so everyone can read it, but since The Information just unlocked this one for HN, we can stick with the original source this time.
  - makomk 7y ago
    Probably for the best, since the Ars Technica article seems rather confused.
brianpgordon 7y ago
> “To be clear—we are using the PushKit VoIP API to deliver a world-class, private messaging experience, not for the purpose of collecting data." I think we must be at the point where it's arguably irresponsible journalism for The Information to broadcast a claim like that from Facebook without immediately pointing out the occasions in the past when identical claims about data collection have turned out to be barefaced lies. Not every reader is going to have that context when reading the article, and they need to be equipped with the appropriate skepticism. I'm not saying we need to dredge up the 90s any time Microsoft speaks publicly about open source. But the Facebook thing is an ongoing issue, and it hasn't been that long since their absolute worst abusive behavior, and there's been no change in management since then. I think it's reasonable that any quote from Facebook denying privacy abuses should be positively dripping with disclaimers. (By the way, I'm loving the articles from The Information when they hit HN. Quality content.)
- ilikehurdles 7y ago
  >not for the purpose of collecting data. That just sounds like skirting the fact that they likely are collecting data.
  - ckosidows 7y ago
    Right. "Not our purpose" != "We aren't doing it"
- SeanBoocock 7y ago
  > "I think we must be at the point where it's arguably irresponsible journalism for The Information to broadcast a claim like that from Facebook without immediately pointing out the occasions in the past when identical claims about data collection have turned out to be barefaced lies." I am struggling to recall any unambiguous instances like you suggest, especially anything rising to the level of "barefaced lies". What would be the best examples? I agree that journalists should give sufficient context about Facebook's history around data and privacy, but I also expect anyone that is subscribing to The Information doesn't need it rehashed for them.
b_tterc_p 7y ago
Messenger app initiated a conversation between me and a random friend so we could talk about our 5 year friendship anniversary. Couldn’t fathom who thought that would work.
- dylan604 7y ago
  While not exactly the same, I see people in Slack workgroups that will dutifully respond to the Slack bot, which can die in a fire. While it's usually welcome someone to the channel or whatever, it's all annoying as hell. So, yes, I can easily see people dutifully following the app's suggestion. Hell, people randomly text their phone number neighbor. People are really just sheep.
- distances 7y ago
  I've been getting these notifications now for a year at least. It's extremely annoying, and I haven't found any way to toggle it off. Such a colossal misfeature. I nowadays only use mbasic.facebook.com to check messages every two to four weeks, as FB is still kind of a backup contact platform for many people if everything else fails.
killjoywashere 7y ago
That last line though: > more of a focus on privacy from the operating systems, and the impact that that can have on measurements and also on targeting. That could have been lifted from an NSA brief. I don't think people realize just how much "targeting" really is indistinguishable from military targeting.
- fourthark 7y ago
  Could just be the editing, but that line read like them admitting, "yeah we're listening all the time, it makes us money".
bubble_talk 7y ago
Facebook engineers know exactly what is going on, and I don't think they actually care. If you want to see exactly how creepy the whole thing is going to get in the future, you just have to take a look at the transcripts from the Software Engineering Daily podcast where a group of engineers from FB were interviewed recently. The interviewer never once mentioned the word privacy in the entire interview across all the five interviews (with pretty senior FB folks who have been there for quite a while). Or for that matter, there wasn't really a single question across all the five interviews which left me thinking "Well, at least there is someone inside Facebook who disagrees at least minimally with company policies". You can search for this in the transcripts yourself. https://softwareengineeringdaily.com/wp-content/uploads/2019/07/SEDFB04-Facebook-GraphQL.pdf https://softwareengineeringdaily.com/wp-content/uploads/2019... https://softwareengineeringdaily.com/wp-content/uploads/2019/07/SEDFB10-Facebook-Open-Source-Management.pdf https://softwareengineeringdaily.com/wp-content/uploads/2019... https://softwareengineeringdaily.com/wp-content/uploads/2019/07/SED874-Facebook-Data-Infrastructure.pdf https://softwareengineeringdaily.com/wp-content/uploads/2019... https://softwareengineeringdaily.com/wp-content/uploads/2019/07/SED873-Facebook-Engineering-Culture.pdf https://softwareengineeringdaily.com/wp-content/uploads/2019... https://softwareengineeringdaily.com/wp-content/uploads/2019/07/SED872-Facebook-PHP.pdf https://softwareengineeringdaily.com/wp-content/uploads/2019...
- tjpnz 7y ago
  >Facebook engineers know exactly what is going on, and I don't think they actually care. I know of founders who would need to think carefully about even interviewing someone with Facebook on their resume. And I totally get these concerns given the attitude Facebook has towards the privacy of users.
  - medecau 7y ago
    > think carefully about even interviewing someone with Facebook on their resume Good, engineers need to be accountable for their complicity.
  - utouq 7y ago
    What a witch hunt. This is akin to persecuting people for their politics.
dwighttk 7y ago
Good. This sort of thing why I don’t have Facebook on my phone.
saagarjha 7y ago
> The impact on battery life briefly made it into the headlines back in 2015 when it was discovered that the main Facebook app was using the voice-calling feature to run in the background. I thought they were just running silent audio?
calimac 7y ago
THANK YOU APPLE!!!!!
buildzr 7y ago
Am I reading this right? If WhatsApp and similar are no longer able to implement End-To-End crypto because they have to use an Apple API which supports only specific protocols, this is going to be a huge loss for users. I've considered switching to an iOS device, but stuff like this keeps me away, I'm very glad I can keep direct SIP, SSH, IMAP and XMPP connections open at all hours of the day.
- EGreg 7y ago
  Doesn’t he mention explicitly in the video that you can use standard notifications and decrypt the payload before showing them? How exactly do you deliver notifications in Android? Can background apps simply listen on an open websocket or something?? What exactly is your technique on android
  - eridius 7y ago
    I haven't watched the video, but Apple has a notifications API specifically for encrypted messaging apps to receive encrypted notifications and run a notification appex that decrypts the notification payload prior to showing the notification to the user.
- fourthark 7y ago
  It wasn't clear why they are using VoIP for WhatsApp. Sounded like it was because it allowed more background processing? I doubt they would ban end to end crypto, but you are right, it is more of a locked down system. Edit: keep reading. People explain this nicely below.
- dep_b 7y ago
  Not being able to lurk in the background does not have anything to do with security. I don’t think Signal uses it and they’re generally considered secure. You can check out their source.
  - auslander 7y ago
    Signal docs say it needs Background permission : "Without this, there may be a delay in sending and receiving messages." https://support.signal.org/hc/en-us/articles/360007062172-Signal-Permissions#ios_permissions https://support.signal.org/hc/en-us/articles/360007062172-Si...
EGreg 7y ago
What are the details? What will change? We will still have VoIP Push Notifications? We personally rely on them to encrypt the notification payloads and increase privacy so our servers can’t read the plaintext of the notification. Is that now going away?
bertman 7y ago
The article focuses on making calls, but moxie (from Signal) had this to say: "PushKit is the only way to do e2e encrypted messaging in iOS. If they take that away, they're disabling the ability for messaging apps to function with e2e encryption. I don't see how Apple can frame that as "enhancing user privacy and security?" " https://twitter.com/moxie/status/1158852855291269120 https://twitter.com/moxie/status/1158852855291269120 So it's not only about being able to answer calls quickly.
- lm2s 7y ago
  I don't understand this commentary by Moxie. Why does removing PushKit functionality removes the ability for apps to do E2EE? The only thing I can think of, is notifications maybe not being encrypted? But that seems like a bit of stretch to say you can't do E2EE messaging.
  - cglong 7y ago
    If the notifications aren't encrypted, then that means it gets decrypted on some server somewhere too :(
    - lm2s 7y ago
      That's not necessarily correct, it would depend of the implementation. See my reply.
  - lm2s 7y ago
    After a quick research* , the conclusion I arrive at is that Moxie stretched the truth. Removing PushKit functionality does not removes the ability for apps to do E2EE messaging. From what I understood: with PushKit, it's possible to send a signal notification to the app. The app then fetches and decrypts new messages and generates appropriate notifications locally. This is also possible to do with regular (silent) Push Notifications. The key difference seems to be that they are low priority and might not be delivered (thus no notification will be generated), and with PushKit it would. So AFAIK this seems to be more an UX issue. * I might be understanding something incorrectly.
justapassenger 7y ago
According to signal devs this is required to do e2ee. I worry apple is starting to use “privacy” as an excuse for any changes. Especially given that they build competing product (iMessage), that’s has all the access rights in the world.
segmondy 7y ago
Well this sucks, I'm using this same feature for a privacy app that I'm working on. It's a useful feature to have. Like all tools it can be used for good or bad. Folks will find ways to circumvent restrictions. Apple should enforce with policy, if someone violates. Remove their app. That hurts more. It's like blackhat SEO, Google delists you, it hurts and many people just don't anymore.

267 points by tareqak 7y ago

For anyone interested in the technical side of the changes getting introduced in iOS 13 regarding messaging apps, the 707 session 'Advances in App Background Execution' of WWDC 2019 is really helpful: https://developer.apple.com/videos/play/wwdc2019/707/ https://developer.apple.com/videos/play/wwdc2019/707/

dang 7y ago

The submitted URL was https://www.theinformation.com/articles/facebook-hit-by-apples-crackdown-on-messaging-feature https://www.theinformation.com/articles/facebook-hit-by-appl..., which was hard-paywalled. But The Information has been unlocking many of their articles for HN readers. I asked if they would do that for this one and they said yes, so everyone who clicks on the link above should be able to read it now.

misiti3780 7y ago
it is still pay-walled for me.
- SalimoS 7y ago
  Use the link in the submission On another note the reader view on iOS (safari on iPadOS 13 public beta) show only first paragraph
rwc 7y ago
Nice, thank you! And thank you to The Information for sharing quality journalism with the HN community.
- ballmers_peak 7y ago
  No problem!
  - icpmacdo 7y ago
    It seems like a smart win win situation for you. I bet if the WSJ ect. did the same it would drive non trivial growth
- freehunter 7y ago
  This is pretty nice and I was considering subscribing because of them lifting the paywall but it doesn’t seem like they show the subscription cost until after you’ve given them your email address and created a password? I always assume if you have to ask the price, you can’t afford it. It just seems when you click the “subscribe now” button it would tell you the price of the subscription on the next page.
  - lyctc 7y ago
    The footer's Payment Policy says: Monthly – $39 Annually – $399
    - hermitdev 7y ago
      $400 annually for a news site as a casual user? Fuck no. Edit: I mean, my wife's Netflix sub is on about $14/month, which we would use far more often than a random single website. About 3x a Netflix subscription for a single "news" site? I think they're dramatically overvalualing themselves.
      - bashwizard 7y ago
        > About 3x a Netflix subscription for a single "news" site? I think they're dramatically overvalualing themselves. The mainstream media in general have been overvalualing themselves for the past decades.
      - 7y ago

hart_russell 7y ago

+1 to Apple's track record for user privacy. I do not regret switching from Android to iOS (even if siri is woefully behind the voice assistant game)

irrational 7y ago
Also autocomplete. I had a samsung phone running android that was almost omniscient in knowing what I wanted to type or keeping track of what I had just been reading or searching for and giving me suggestions based on that (like if I had been reading about a restaurant and then went to send a text to my wife it would give me prompts about the restaurant, which is exactly what I wanted). iOS autocomplete is woefully subpar in comparison.
- airstrike 7y ago
  Just install SwiftKey. The native iOS keyboard is absolutely appalling, I don't wish it upon my worst enemy...
  - buzzert 7y ago
    Why is it appalling? Can you be more specific?
    - smallbigfish 7y ago
      That even today many European languages don't even have a basic dictionary. I'm not talking about the "guess the next word" feature. All I want is a dictionary that could suggest a correction to a misspelled word. Use two languages at once? No way! I guess they need to invent a new chip or something. Swipe to type? Hehe. The keyboard in itself is fast and good but it lacks features.
      - kalleboo 7y ago
        > Swipe to type? Hehe That's finally coming in iOS 13

kingo55 7y ago

What's with the login wall to read the article? Does every random site need my personal information now?

randall 7y ago
It's a paid site.
jvagner 7y ago
It’s a pay site. Logging in gives the, a chance to upsell.
- kingo55 7y ago
  How misleading.
  - Operyl 7y ago
    I mean, given the entire verbiage around the sites login wall, it seemed plenty obvious here.
    - kingo55 7y ago
      Maybe... I don't pay much attention to sales pitches. Just saw 'Read this article for free" and a login button and assumed as much. It'll convert well for them at least.
pcora 7y ago
Many sites do that nowadays. The Information seems to be pretty nice, but it's super expensive. At least to me.
IfOnlyYouKnew 7y ago
The Information isn't that random (as the name implies). It's an attempt to create a high-value, investigative tech magazine. The paywall is rather strict and it seems to be aimed at the investor class, so I'm not entirely sure how well it's going because I'm not a subscriber, but I believe I've seen a few important stories that originated with them.

_bxg1 7y ago

It's a shame that in today's world we have to choose between platforms that are open-ended and platforms whose software respects its users. But given that choice, I support this outcome.

medecau 7y ago
It's very hard to provide both as abusive software (malware) tends to take advantage of the open-endedness of platformas to abuse the users.
- simonh 7y ago
  It’s worse than that even. Open platforms that are popular get commoditised easily, which squeezes margins for vendors, increasing pressure to monetize by any means possible. The race to the bottom does benefit customers in terms of prices, but there are real costs in terms of the quality and trustworthiness of the products. The cheapest products are most likely to be monetising in shady ways.

therealmarv 7y ago

Essence from this site (from my understanding, read the whole article): WhatsApp is using VoIP iOS features to display end2end encrypted notifications in iOS. This loophole will be closed on iOS13. So either WhatsApp does not display any notifications text on iOS13 with WhatsApp or WhatsApp will remove end2end encryption for the sake of having notifications with text on iOS. This is really alarming for privacy. Seems Apple does not care about privacy and comfort unless it's software from Apple. I just hope WhatsApp will stay strong and never give up on end2end encryption.

acdha 7y ago
It has nothing to do with end-to-end encryption: they’re abusing the VoIP feature to stay running in the background, which is trading battery life for better surveillance of your activities. Apple is doing it to _protect_ privacy by closing one of the ways unscrupulous app developers keep trackers running.
- mantap 7y ago
  The use of voip mode is well established technique for building encrypted messaging apps on iOS, and its unsurprising that whatsapp is built around it, especially when you consider that whatsapp is a voip app. No conspiracy theories are necessary.
  - tareqak 7y ago
    Are Signal and other messaging apps relying on this feature and do they offer VoIP functionality?
    - makomk 7y ago
      As far as I can tell, that's a yes to both: Signal supports VoIP calls, they're definitely using the PushKit VoIP API, and I assume they're using that API for both text notifications and calls since the code doesn't have any reference to the other API they could use.
- 7y ago

workingpatrick 7y ago

If you don't want to provide your email address I put the article here https://pastebin.com/kKSNFnm8 https://pastebin.com/kKSNFnm8

codeulike 7y ago

I've noticed something sneaky about Facebook on my phone. I refuse to install their apps but I do use Facebook a bit so I use it via the phone Browser (in my case, Chrome on Android). I've noticed that sometimes Facebook shows a fake 'youve got a message' icon to try and trick you into installing their messenger app. To re-produce this behaviour: (this works best if you dont get a lot of facebook messages. Also you need a phone with no facebook apps installed) - On your desktop PC, use facebook to send a message to someone - Then switch to your phone, using facebook in the browser - After about an hour, the little speechbubble message icon at the top will go red, showing you've got a message - If you click on this from a phone browser, it redirects you to install messenger. (normally, phone-browser facebook doesnt do messenger features) - Instead of that, switch on 'request desktop site' (not sure what iOS calls this option) to make your phone display the desktop version of facebook. And then you can (usually) read your messages in the browser - But you will find that there is no new message, and the new message icon will no longer be lit up. I've had this happen five or six times now - supposedly new messages have arrived but when you look there are none. It always happens about an hour after sending a message. I'm pretty convinced its deliberate behaviour on the phone browser version of facebook to get you to install their messenger app.

andyhmltn 7y ago
I’ve noticed the same with their notifications. As of right now, I have 1 notification. I will open the menu and see there’s not actually anything there. The badge then goes away. Refresh the page and it’s there again despite not having any notifications
oceanghost 7y ago
This is absolutely a dark pattern. I sometimes install the FB app if I need to check something, but NEVER the messaging app. And the FB app will always claim I have 5 or so messages... Which of course is never actually true.
Forge36 7y ago
Mine is currently in this state. I want aware it ever stopped.
7y ago

yipeedipee 7y ago

Ars just covered it: https://arstechnica.com/gadgets/2019/08/ios-13-privacy-feature-will-force-total-overhaul-for-facebook-apps/ https://arstechnica.com/gadgets/2019/08/ios-13-privacy-featu...

dang 7y ago
Normally we'd switch to something like that so everyone can read it, but since The Information just unlocked this one for HN, we can stick with the original source this time.
- makomk 7y ago
  Probably for the best, since the Ars Technica article seems rather confused.

brianpgordon 7y ago

> “To be clear—we are using the PushKit VoIP API to deliver a world-class, private messaging experience, not for the purpose of collecting data." I think we must be at the point where it's arguably irresponsible journalism for The Information to broadcast a claim like that from Facebook without immediately pointing out the occasions in the past when identical claims about data collection have turned out to be barefaced lies. Not every reader is going to have that context when reading the article, and they need to be equipped with the appropriate skepticism. I'm not saying we need to dredge up the 90s any time Microsoft speaks publicly about open source. But the Facebook thing is an ongoing issue, and it hasn't been that long since their absolute worst abusive behavior, and there's been no change in management since then. I think it's reasonable that any quote from Facebook denying privacy abuses should be positively dripping with disclaimers. (By the way, I'm loving the articles from The Information when they hit HN. Quality content.)

ilikehurdles 7y ago
>not for the purpose of collecting data. That just sounds like skirting the fact that they likely are collecting data.
- ckosidows 7y ago
  Right. "Not our purpose" != "We aren't doing it"
SeanBoocock 7y ago
> "I think we must be at the point where it's arguably irresponsible journalism for The Information to broadcast a claim like that from Facebook without immediately pointing out the occasions in the past when identical claims about data collection have turned out to be barefaced lies." I am struggling to recall any unambiguous instances like you suggest, especially anything rising to the level of "barefaced lies". What would be the best examples? I agree that journalists should give sufficient context about Facebook's history around data and privacy, but I also expect anyone that is subscribing to The Information doesn't need it rehashed for them.

b_tterc_p 7y ago

Messenger app initiated a conversation between me and a random friend so we could talk about our 5 year friendship anniversary. Couldn’t fathom who thought that would work.

dylan604 7y ago
While not exactly the same, I see people in Slack workgroups that will dutifully respond to the Slack bot, which can die in a fire. While it's usually welcome someone to the channel or whatever, it's all annoying as hell. So, yes, I can easily see people dutifully following the app's suggestion. Hell, people randomly text their phone number neighbor. People are really just sheep.
distances 7y ago
I've been getting these notifications now for a year at least. It's extremely annoying, and I haven't found any way to toggle it off. Such a colossal misfeature. I nowadays only use mbasic.facebook.com to check messages every two to four weeks, as FB is still kind of a backup contact platform for many people if everything else fails.

killjoywashere 7y ago

That last line though: > more of a focus on privacy from the operating systems, and the impact that that can have on measurements and also on targeting. That could have been lifted from an NSA brief. I don't think people realize just how much "targeting" really is indistinguishable from military targeting.

fourthark 7y ago
Could just be the editing, but that line read like them admitting, "yeah we're listening all the time, it makes us money".

bubble_talk 7y ago

Facebook engineers know exactly what is going on, and I don't think they actually care. If you want to see exactly how creepy the whole thing is going to get in the future, you just have to take a look at the transcripts from the Software Engineering Daily podcast where a group of engineers from FB were interviewed recently. The interviewer never once mentioned the word privacy in the entire interview across all the five interviews (with pretty senior FB folks who have been there for quite a while). Or for that matter, there wasn't really a single question across all the five interviews which left me thinking "Well, at least there is someone inside Facebook who disagrees at least minimally with company policies". You can search for this in the transcripts yourself. https://softwareengineeringdaily.com/wp-content/uploads/2019/07/SEDFB04-Facebook-GraphQL.pdf https://softwareengineeringdaily.com/wp-content/uploads/2019... https://softwareengineeringdaily.com/wp-content/uploads/2019/07/SEDFB10-Facebook-Open-Source-Management.pdf https://softwareengineeringdaily.com/wp-content/uploads/2019... https://softwareengineeringdaily.com/wp-content/uploads/2019/07/SED874-Facebook-Data-Infrastructure.pdf https://softwareengineeringdaily.com/wp-content/uploads/2019... https://softwareengineeringdaily.com/wp-content/uploads/2019/07/SED873-Facebook-Engineering-Culture.pdf https://softwareengineeringdaily.com/wp-content/uploads/2019... https://softwareengineeringdaily.com/wp-content/uploads/2019/07/SED872-Facebook-PHP.pdf https://softwareengineeringdaily.com/wp-content/uploads/2019...

tjpnz 7y ago
>Facebook engineers know exactly what is going on, and I don't think they actually care. I know of founders who would need to think carefully about even interviewing someone with Facebook on their resume. And I totally get these concerns given the attitude Facebook has towards the privacy of users.
- medecau 7y ago
  > think carefully about even interviewing someone with Facebook on their resume Good, engineers need to be accountable for their complicity.
- utouq 7y ago
  What a witch hunt. This is akin to persecuting people for their politics.

dwighttk 7y ago

Good. This sort of thing why I don’t have Facebook on my phone.

saagarjha 7y ago

> The impact on battery life briefly made it into the headlines back in 2015 when it was discovered that the main Facebook app was using the voice-calling feature to run in the background. I thought they were just running silent audio?

calimac 7y ago

THANK YOU APPLE!!!!!

buildzr 7y ago

Am I reading this right? If WhatsApp and similar are no longer able to implement End-To-End crypto because they have to use an Apple API which supports only specific protocols, this is going to be a huge loss for users. I've considered switching to an iOS device, but stuff like this keeps me away, I'm very glad I can keep direct SIP, SSH, IMAP and XMPP connections open at all hours of the day.

EGreg 7y ago
Doesn’t he mention explicitly in the video that you can use standard notifications and decrypt the payload before showing them? How exactly do you deliver notifications in Android? Can background apps simply listen on an open websocket or something?? What exactly is your technique on android
- eridius 7y ago
  I haven't watched the video, but Apple has a notifications API specifically for encrypted messaging apps to receive encrypted notifications and run a notification appex that decrypts the notification payload prior to showing the notification to the user.
fourthark 7y ago
It wasn't clear why they are using VoIP for WhatsApp. Sounded like it was because it allowed more background processing? I doubt they would ban end to end crypto, but you are right, it is more of a locked down system. Edit: keep reading. People explain this nicely below.
dep_b 7y ago
Not being able to lurk in the background does not have anything to do with security. I don’t think Signal uses it and they’re generally considered secure. You can check out their source.
- auslander 7y ago
  Signal docs say it needs Background permission : "Without this, there may be a delay in sending and receiving messages." https://support.signal.org/hc/en-us/articles/360007062172-Signal-Permissions#ios_permissions https://support.signal.org/hc/en-us/articles/360007062172-Si...

EGreg 7y ago

What are the details? What will change? We will still have VoIP Push Notifications? We personally rely on them to encrypt the notification payloads and increase privacy so our servers can’t read the plaintext of the notification. Is that now going away?

bertman 7y ago

The article focuses on making calls, but moxie (from Signal) had this to say: "PushKit is the only way to do e2e encrypted messaging in iOS. If they take that away, they're disabling the ability for messaging apps to function with e2e encryption. I don't see how Apple can frame that as "enhancing user privacy and security?" " https://twitter.com/moxie/status/1158852855291269120 https://twitter.com/moxie/status/1158852855291269120 So it's not only about being able to answer calls quickly.

lm2s 7y ago
I don't understand this commentary by Moxie. Why does removing PushKit functionality removes the ability for apps to do E2EE? The only thing I can think of, is notifications maybe not being encrypted? But that seems like a bit of stretch to say you can't do E2EE messaging.
- cglong 7y ago
  If the notifications aren't encrypted, then that means it gets decrypted on some server somewhere too :(
  - lm2s 7y ago
    That's not necessarily correct, it would depend of the implementation. See my reply.
- lm2s 7y ago
  After a quick research* , the conclusion I arrive at is that Moxie stretched the truth. Removing PushKit functionality does not removes the ability for apps to do E2EE messaging. From what I understood: with PushKit, it's possible to send a signal notification to the app. The app then fetches and decrypts new messages and generates appropriate notifications locally. This is also possible to do with regular (silent) Push Notifications. The key difference seems to be that they are low priority and might not be delivered (thus no notification will be generated), and with PushKit it would. So AFAIK this seems to be more an UX issue. * I might be understanding something incorrectly.

justapassenger 7y ago

According to signal devs this is required to do e2ee. I worry apple is starting to use “privacy” as an excuse for any changes. Especially given that they build competing product (iMessage), that’s has all the access rights in the world.

segmondy 7y ago

Well this sucks, I'm using this same feature for a privacy app that I'm working on. It's a useful feature to have. Like all tools it can be used for good or bad. Folks will find ways to circumvent restrictions. Apple should enforce with policy, if someone violates. Remove their app. That hurts more. It's like blackhat SEO, Google delists you, it hurts and many people just don't anymore.