4 ms·

The article focuses on making calls, but moxie (from Signal) had this to say: "PushKit is the only way to do e2e encrypted messaging in iOS. If they take that

The article focuses on making calls, but moxie (from Signal) had this to say: "PushKit is the only way to do e2e encrypted messaging in iOS. If they take that away, they're disabling the ability for messaging apps to function with e2e encryption. I don't see how Apple can frame that as "enhancing user privacy and security?" " https://twitter.com/moxie/status/1158852855291269120 https://twitter.com/moxie/status/1158852855291269120 So it's not only about being able to answer calls quickly.

lm2s 7y ago
I don't understand this commentary by Moxie. Why does removing PushKit functionality removes the ability for apps to do E2EE? The only thing I can think of, is notifications maybe not being encrypted? But that seems like a bit of stretch to say you can't do E2EE messaging.
- cglong 7y ago
  If the notifications aren't encrypted, then that means it gets decrypted on some server somewhere too :(
  - lm2s 7y ago
    That's not necessarily correct, it would depend of the implementation. See my reply.
- lm2s 7y ago
  After a quick research* , the conclusion I arrive at is that Moxie stretched the truth. Removing PushKit functionality does not removes the ability for apps to do E2EE messaging. From what I understood: with PushKit, it's possible to send a signal notification to the app. The app then fetches and decrypts new messages and generates appropriate notifications locally. This is also possible to do with regular (silent) Push Notifications. The key difference seems to be that they are low priority and might not be delivered (thus no notification will be generated), and with PushKit it would. So AFAIK this seems to be more an UX issue. * I might be understanding something incorrectly.
  - thepangolino 7y ago
    Don't take my word for it but I believe that's the approach Telegrarm has.
GeekyBear 7y ago
You still have the ability to use an extension that decrypts push notifications on the device when your app is not running. >A UNNotificationServiceExtension object provides the entry point for a Notification Service app extension, which lets you customize the content of a remote notification before it is delivered to the user. A Notification Service app extension doesn't present any UI of its own. Instead, it is launched on demand when a notification of the appropriate type is delivered to the user’s device. You use this extension to modify the notification’s content or download content related to the extension. For example, you could use the extension to decrypt an encrypted data block or to download images associated with the notification. https://developer.apple.com/documentation/usernotifications/unnotificationserviceextension https://developer.apple.com/documentation/usernotifications/...
- octorian 7y ago
  One thing that's easy to miss, is that there's a lot of background processing essential for usable E2E that doesn't actually result in a user-visible notification. Much of this involves the local app doing some sort of server interaction in response to a push. This could include responding to a message retry request, uploading new keys, handling receipts, etc.
segmondy 7y ago
Apple wants to commoditize privacy. They're running out of things to do. They will frame themselves as the new guard.

lm2s 7y ago

I don't understand this commentary by Moxie. Why does removing PushKit functionality removes the ability for apps to do E2EE? The only thing I can think of, is notifications maybe not being encrypted? But that seems like a bit of stretch to say you can't do E2EE messaging.

cglong 7y ago
If the notifications aren't encrypted, then that means it gets decrypted on some server somewhere too :(
- lm2s 7y ago
  That's not necessarily correct, it would depend of the implementation. See my reply.
lm2s 7y ago
After a quick research* , the conclusion I arrive at is that Moxie stretched the truth. Removing PushKit functionality does not removes the ability for apps to do E2EE messaging. From what I understood: with PushKit, it's possible to send a signal notification to the app. The app then fetches and decrypts new messages and generates appropriate notifications locally. This is also possible to do with regular (silent) Push Notifications. The key difference seems to be that they are low priority and might not be delivered (thus no notification will be generated), and with PushKit it would. So AFAIK this seems to be more an UX issue. * I might be understanding something incorrectly.
- thepangolino 7y ago
  Don't take my word for it but I believe that's the approach Telegrarm has.

GeekyBear 7y ago

You still have the ability to use an extension that decrypts push notifications on the device when your app is not running. >A UNNotificationServiceExtension object provides the entry point for a Notification Service app extension, which lets you customize the content of a remote notification before it is delivered to the user. A Notification Service app extension doesn't present any UI of its own. Instead, it is launched on demand when a notification of the appropriate type is delivered to the user’s device. You use this extension to modify the notification’s content or download content related to the extension. For example, you could use the extension to decrypt an encrypted data block or to download images associated with the notification. https://developer.apple.com/documentation/usernotifications/unnotificationserviceextension https://developer.apple.com/documentation/usernotifications/...

octorian 7y ago
One thing that's easy to miss, is that there's a lot of background processing essential for usable E2E that doesn't actually result in a user-visible notification. Much of this involves the local app doing some sort of server interaction in response to a push. This could include responding to a message retry request, uploading new keys, handling receipts, etc.

segmondy 7y ago

Apple wants to commoditize privacy. They're running out of things to do. They will frame themselves as the new guard.