4 ms·

Essence from this site (from my understanding, read the whole article): WhatsApp is using VoIP iOS features to display end2end encrypted notifications in iOS.

Essence from this site (from my understanding, read the whole article): WhatsApp is using VoIP iOS features to display end2end encrypted notifications in iOS. This loophole will be closed on iOS13. So either WhatsApp does not display any notifications text on iOS13 with WhatsApp or WhatsApp will remove end2end encryption for the sake of having notifications with text on iOS. This is really alarming for privacy. Seems Apple does not care about privacy and comfort unless it's software from Apple. I just hope WhatsApp will stay strong and never give up on end2end encryption.

acdha 7y ago
It has nothing to do with end-to-end encryption: they’re abusing the VoIP feature to stay running in the background, which is trading battery life for better surveillance of your activities. Apple is doing it to _protect_ privacy by closing one of the ways unscrupulous app developers keep trackers running.
- mantap 7y ago
  The use of voip mode is well established technique for building encrypted messaging apps on iOS, and its unsurprising that whatsapp is built around it, especially when you consider that whatsapp is a voip app. No conspiracy theories are necessary.
  - tareqak 7y ago
    Are Signal and other messaging apps relying on this feature and do they offer VoIP functionality?
    - makomk 7y ago
      As far as I can tell, that's a yes to both: Signal supports VoIP calls, they're definitely using the PushKit VoIP API, and I assume they're using that API for both text notifications and calls since the code doesn't have any reference to the other API they could use.
- makomk 7y ago
  It has everything to do with end-to-end encryption. Prior to iOS 10, the only way to display notifications for end-to-end encrypted chat without giving Apple a plaintext copy of everything in the notification was to abuse the VoIP feature. More specifically, the "PushKit VoIP API" Facebook's spokesperson mentioned allowed services to push down an opaque blob of data and have their apps immediately wake up in the background, do some processing (such as decryption), maybe get more data from the network, and create a notification. This was intended to support incoming voice calls but worked great for end-to-end encrypted text chat. Now Apple are cracking down on the use of that VoIP background functionality for anything but voice calls. It might be possible for companies like Facebook to rewrite their code to use an iOS 10+ Notification Service app extension to decrypt the notifications instead, but that requires major code changes and has additional limitations. Also, from what I can tell Facebook Messenger etc haven't had access to the old APIs which just let VoIP apps run in the background all the time since about 2016. That's not available for apps linked to the iOS 10 API and they've been using the iOS-10-only CallKit since about that time.
  - deleted 7y ago
    [deleted]
  - comex 7y ago
    > It might be possible for companies like Facebook to rewrite their code to use an iOS 10+ Notification Service app extension to decrypt the notifications instead, but that requires major code changes and has additional limitations. Perhaps, but iOS 10 is now 3 years old; Facebook has had plenty of time to make those major code changes, as opposed to continuing to use VoIP push notifications for things other than VoIP.
    - dan-robertson 7y ago
      Facebook aren’t obliged to make a change just because they can. Taking something that works and changing it for its own sake is something people very often get annoyed about.
      - 7y ago
zacwest 7y ago
It's not the case that they would need to give up encrypted notifications. Developers can support end-to-end encrypted notifications by creating a UNNotificationServiceExtension[1]. This is an extension which receives and can mutate the notification before it's shown to the user. [1]: https://developer.apple.com/documentation/usernotifications/unnotificationserviceextension https://developer.apple.com/documentation/usernotifications/... Straight from Apple's documentation: > For example, you could use the extension to decrypt an encrypted data block or to download images associated with the notification.
- therealmarv 7y ago
  Thanks for the link. So when FB/WhatsApp will adapt it will work as before. That's great news.

acdha 7y ago

It has nothing to do with end-to-end encryption: they’re abusing the VoIP feature to stay running in the background, which is trading battery life for better surveillance of your activities. Apple is doing it to _protect_ privacy by closing one of the ways unscrupulous app developers keep trackers running.

mantap 7y ago
The use of voip mode is well established technique for building encrypted messaging apps on iOS, and its unsurprising that whatsapp is built around it, especially when you consider that whatsapp is a voip app. No conspiracy theories are necessary.
- tareqak 7y ago
  Are Signal and other messaging apps relying on this feature and do they offer VoIP functionality?
  - makomk 7y ago
    As far as I can tell, that's a yes to both: Signal supports VoIP calls, they're definitely using the PushKit VoIP API, and I assume they're using that API for both text notifications and calls since the code doesn't have any reference to the other API they could use.
makomk 7y ago
It has everything to do with end-to-end encryption. Prior to iOS 10, the only way to display notifications for end-to-end encrypted chat without giving Apple a plaintext copy of everything in the notification was to abuse the VoIP feature. More specifically, the "PushKit VoIP API" Facebook's spokesperson mentioned allowed services to push down an opaque blob of data and have their apps immediately wake up in the background, do some processing (such as decryption), maybe get more data from the network, and create a notification. This was intended to support incoming voice calls but worked great for end-to-end encrypted text chat. Now Apple are cracking down on the use of that VoIP background functionality for anything but voice calls. It might be possible for companies like Facebook to rewrite their code to use an iOS 10+ Notification Service app extension to decrypt the notifications instead, but that requires major code changes and has additional limitations. Also, from what I can tell Facebook Messenger etc haven't had access to the old APIs which just let VoIP apps run in the background all the time since about 2016. That's not available for apps linked to the iOS 10 API and they've been using the iOS-10-only CallKit since about that time.
- deleted 7y ago
  [deleted]
- comex 7y ago
  > It might be possible for companies like Facebook to rewrite their code to use an iOS 10+ Notification Service app extension to decrypt the notifications instead, but that requires major code changes and has additional limitations. Perhaps, but iOS 10 is now 3 years old; Facebook has had plenty of time to make those major code changes, as opposed to continuing to use VoIP push notifications for things other than VoIP.
  - dan-robertson 7y ago
    Facebook aren’t obliged to make a change just because they can. Taking something that works and changing it for its own sake is something people very often get annoyed about.
    - 7y ago

zacwest 7y ago

It's not the case that they would need to give up encrypted notifications. Developers can support end-to-end encrypted notifications by creating a UNNotificationServiceExtension[1]. This is an extension which receives and can mutate the notification before it's shown to the user. [1]: https://developer.apple.com/documentation/usernotifications/unnotificationserviceextension https://developer.apple.com/documentation/usernotifications/... Straight from Apple's documentation: > For example, you could use the extension to decrypt an encrypted data block or to download images associated with the notification.

therealmarv 7y ago
Thanks for the link. So when FB/WhatsApp will adapt it will work as before. That's great news.