5 ms·

Why does Apple even have access to push notifications?

whartung 3y ago
Apple routes all of them. Company sends message to Apple. Apple sends the message to your phone. App on phone delivers the message to you.
- DeathArrow 3y ago
  > Apple sends the message to your phone. The "send" part I understand. What I don't understand is the "store" part. And is the Apple's routing even needed? Web push notification don't need Apple, Google, Microsoft or Ubuntu between the web app and you. Can't app push notifications work in the same way?
  - ben-schaaf 3y ago
    Web Push uses a browser provided "push-service", so if you're using the push API your notifications are already going through Apple.
  - kyelewis 3y ago
    Web push notifications do need and use Apple, Google… between the web app and you.
  - jasode 3y ago
    >Web push notification don't need Apple, Google, Microsoft or Ubuntu between the web app and you. They do. To implement "web push", each web browser vendor has their own backend server to handle notification subscriptions[1][2]. - Mozilla Firefox uses their server at "push.services.mozilla.com" - Google Chrome uses their server "fcm.googleapis.com" - Apple Safari uses "api.push.apple.com" - MS Edge uses their Windows Notification API server [1] https://stackoverflow.com/questions/53169001/web-push-do-they-use-public-servers-like-google-etc/53378967#53378967 https://stackoverflow.com/questions/53169001/web-push-do-the... [2] https://stackoverflow.com/questions/48683770/how-are-web-push-messages-delivered/48684217#48684217 https://stackoverflow.com/questions/48683770/how-are-web-pus... [3] https://news.ycombinator.com/item?id=38430226 https://news.ycombinator.com/item?id=38430226 The web push architecture requiring middleman servers in between the website and the browser is similar to native iOS apps requiring the APNS server (Apple Push Notification Server): [4] https://stackoverflow.com/questions/17262511/how-do-ios-push-notifications-work/30617904#30617904 https://stackoverflow.com/questions/17262511/how-do-ios-push...
  - rollcat 3y ago
    It's a trade-off. If the device is not able to receive the notification at the time it was sent out, it has to be stored somewhere, pending delivery. It's the same with email, SMS, literally every messenger app, heck it's the same with physical parcels! You could argue the protocol should allow the sender to store the message, to allow the receiver to fetch it directly, without a middleman - and this is more or less what RSS is, except the polling architecture causes both extra latency and increased server load. But we could "fix" RSS by eliminating polling, etc - that's an easy engineering problem, the true issue would be standards/consensus. Finally, since we're talking mobile devices, you must consider battery usage. It's cheaper to keep only a single TCP connection open; this path is heavily optimized at every layer of the stack, from network hardware and drivers to the app-facing API. Notably, email notifications have to go through their own network path (there's a couple of IMAP extensions to enable push), this is part of the reason why some email apps would like to look at your email from the POV of their own hosted backend. These choices reflect the fundamental problems of mobile messaging. But we could still improve upon the status quo - like requiring E2EE for notification payload. That would be a huge effort though, as an app vendor you already need to implement APNS/FCM/Web (all very different from one another), and I'm sure every middleman would like to build their encryption slightly differently. Adoption would be slow and painful.
    - jasode 3y ago
      >, it has to be stored somewhere, pending delivery. I think the "stored?" question isn't about the minimal fraction of time notifications have to be in transient storage to even "send and immediately forget". Yes, a transitory "message queue pub/sub" architecture still needs to have some notion of "storage" to work. Instead, "stored?" is wondering about a company's discretionary and optional retention period after the successful notification delivery that isn't required by law. E.g. 30 days?, or 1 year?, or longer? ... such that those archive records of past notifications have become targets for court subpoenas and law enforcement information requests. If Apple doesn't "store" notifications in this sense, there's nothing to "hand over".
heavyset_go 3y ago
Apple forces you to use their notification service. At one point, they even tried to force desktop users of Safari to be bound to their notification service instead of being able to use web push notifications, as well. Apps distributed on the Play Store also have to use Google's notification service.
- ksjskskskkk 3y ago
  not exactly. on ios it's 100% their servers with wide open data. elsewhere if you use firefox their webnotification push servers use a e2ee schema. also on Android apps have the option to not use google's server and pull (e.g. ntfy) ... aren't you glad you bought an iphone thanks to all that "we respect your privacy" marketing? /s
  - cubefox 3y ago
    If you are forced to use a third party for push notifications, there should be end-to-end encryption by default. Really strange they don't do this.
  - Klonoar 3y ago
    It’s “wide open data” if app developers choose to build that way. It’s not rocket science to obscure push notification data. Your beef should be with the app devs who don’t go the extra mile, not Apple.
    - withinboredom 3y ago
      If I sent a message to a group of friends, you don't need to know the contents if all you want to know is who my friends are. Just look for groups of people getting notifications at the same time. After a few messages, you'll know exactly who is in that group. I did some anonymization across hundreds of millions of users for some GDPR stuff a few years ago. If I knew when you made a purchase, to within a day, for two separate one-off purchases of our products ... I could deanonymize you. Specifically just you. If you had a subscription payment, and I knew at least one payment you were late on, and the hour you eventually paid it ... I could deanonymize you down to a group of 3-4 people. Correlation and timing are huge for deanonymizing things in otherwise anonymous data. We had to round our dates to the week to keep some of our analytical data anonymous.
harrygeez 3y ago
If every app need to poll different servers periodically or, listen for pushes, it will be a nightmare for battery life and be a big detriment to phone resource usage.
- notsylver 3y ago
  That shouldn't stop them from encrypting the contents and making it intentionally difficult to draw conclusions from?
  - thfuran 3y ago
    You can draw plenty of conclusions from the metadata.
- idle_zealot 3y ago
  Sure, but shouldn't this be e2e encrypted? You could probably come up with a scheme such that Apple doesn't know the contents, sending app or recipient device.
  - zarzavat 3y ago
    It should. I am sure that Apple will be working on this now. It’s unfortunate that they didn’t implement it before. Maybe Apple itself didn’t realise that this data was being taken by the authorities, and the parts of Apple that did know were not allowed to inform engineering.
  - JimDabell 3y ago
    This is up to app developers to implement themselves. The mechanism Apple provides for this is UNNotificationServiceExtension, which allows an app to step in before a notification is delivered so that it can do things like decrypt it. https://developer.apple.com/documentation/usernotifications/unnotificationserviceextension https://developer.apple.com/documentation/usernotifications/...
    - cubefox 3y ago
vaxman 3y ago
Push is a just technique for minimizing (scarce wireless) bandwidth, battery and RAM consumption, which was critical in the mass deployment of the initial iPhone on AT&T. iPhone developers typically aren’t very skilled and they will stuff things into APNS payloads without thinking through the consequences (they’re just happy to get something working at all and more often than not, are in some remote country that doesn’t allow familiarizing with the user context) so this is definitely a privacy concern whether due to legal interception or hacking. Perhaps a future version of SwiftUI (and what Xcode Cloud may evolve into) will implement a simple E2E Push scheme by default, allowing Apple to spend more time reviewing the Push API use by the remaining legacy apps. But…take comfort in knowing that at least Apple’s server is not purposely located across national boundaries (like Blackberry). That’s good because users have no expectation of privacy from monitoring (by US government or otherwise) when using servers (or when they themselves are) on foreign soil. Meanwhile, US let 12,000 unknown persons literally wander across the border in just a single day last week (US can only handle 1,000 border crossers on a good day) and some are committing horrible crimes (https://foxsanantonio.com/amp/newsletter-daily/undocumented-migrant-charged-with-16-year-old-cheerleaders-murder-edna-texas-investigation-rangers-police-evidence https://foxsanantonio.com/amp/newsletter-daily/undocumented-...) —and yes, they do have Android and iPhones. The US is also sinking another $1T in (unfunded) debt every 90 days (meaning another Great Depression is not out of the question) and maybe it’s time to better focus our resources, for example, (after 40 years) China seems just about done surveying western IP and is clearly moving into a new era by having their massive APT groups (collectively 50x larger than US cyber forces) operate crude things like MoonBounce deployments —we have almost no monitoring for factory-installed threats, we’re totally wide open. https://youtu.be/j7OHG7tHrNM https://youtu.be/j7OHG7tHrNM

Apple routes all of them. Company sends message to Apple. Apple sends the message to your phone. App on phone delivers the message to you.

DeathArrow 3y ago
> Apple sends the message to your phone. The "send" part I understand. What I don't understand is the "store" part. And is the Apple's routing even needed? Web push notification don't need Apple, Google, Microsoft or Ubuntu between the web app and you. Can't app push notifications work in the same way?
- ben-schaaf 3y ago
  Web Push uses a browser provided "push-service", so if you're using the push API your notifications are already going through Apple.
- kyelewis 3y ago
  Web push notifications do need and use Apple, Google… between the web app and you.
- jasode 3y ago
  >Web push notification don't need Apple, Google, Microsoft or Ubuntu between the web app and you. They do. To implement "web push", each web browser vendor has their own backend server to handle notification subscriptions[1][2]. - Mozilla Firefox uses their server at "push.services.mozilla.com" - Google Chrome uses their server "fcm.googleapis.com" - Apple Safari uses "api.push.apple.com" - MS Edge uses their Windows Notification API server [1] https://stackoverflow.com/questions/53169001/web-push-do-they-use-public-servers-like-google-etc/53378967#53378967 https://stackoverflow.com/questions/53169001/web-push-do-the... [2] https://stackoverflow.com/questions/48683770/how-are-web-push-messages-delivered/48684217#48684217 https://stackoverflow.com/questions/48683770/how-are-web-pus... [3] https://news.ycombinator.com/item?id=38430226 https://news.ycombinator.com/item?id=38430226 The web push architecture requiring middleman servers in between the website and the browser is similar to native iOS apps requiring the APNS server (Apple Push Notification Server): [4] https://stackoverflow.com/questions/17262511/how-do-ios-push-notifications-work/30617904#30617904 https://stackoverflow.com/questions/17262511/how-do-ios-push...
- rollcat 3y ago
  It's a trade-off. If the device is not able to receive the notification at the time it was sent out, it has to be stored somewhere, pending delivery. It's the same with email, SMS, literally every messenger app, heck it's the same with physical parcels! You could argue the protocol should allow the sender to store the message, to allow the receiver to fetch it directly, without a middleman - and this is more or less what RSS is, except the polling architecture causes both extra latency and increased server load. But we could "fix" RSS by eliminating polling, etc - that's an easy engineering problem, the true issue would be standards/consensus. Finally, since we're talking mobile devices, you must consider battery usage. It's cheaper to keep only a single TCP connection open; this path is heavily optimized at every layer of the stack, from network hardware and drivers to the app-facing API. Notably, email notifications have to go through their own network path (there's a couple of IMAP extensions to enable push), this is part of the reason why some email apps would like to look at your email from the POV of their own hosted backend. These choices reflect the fundamental problems of mobile messaging. But we could still improve upon the status quo - like requiring E2EE for notification payload. That would be a huge effort though, as an app vendor you already need to implement APNS/FCM/Web (all very different from one another), and I'm sure every middleman would like to build their encryption slightly differently. Adoption would be slow and painful.
  - jasode 3y ago
    >, it has to be stored somewhere, pending delivery. I think the "stored?" question isn't about the minimal fraction of time notifications have to be in transient storage to even "send and immediately forget". Yes, a transitory "message queue pub/sub" architecture still needs to have some notion of "storage" to work. Instead, "stored?" is wondering about a company's discretionary and optional retention period after the successful notification delivery that isn't required by law. E.g. 30 days?, or 1 year?, or longer? ... such that those archive records of past notifications have become targets for court subpoenas and law enforcement information requests. If Apple doesn't "store" notifications in this sense, there's nothing to "hand over".

heavyset_go 3y ago

Apple forces you to use their notification service. At one point, they even tried to force desktop users of Safari to be bound to their notification service instead of being able to use web push notifications, as well. Apps distributed on the Play Store also have to use Google's notification service.

ksjskskskkk 3y ago
not exactly. on ios it's 100% their servers with wide open data. elsewhere if you use firefox their webnotification push servers use a e2ee schema. also on Android apps have the option to not use google's server and pull (e.g. ntfy) ... aren't you glad you bought an iphone thanks to all that "we respect your privacy" marketing? /s
- cubefox 3y ago
  If you are forced to use a third party for push notifications, there should be end-to-end encryption by default. Really strange they don't do this.
- Klonoar 3y ago
  It’s “wide open data” if app developers choose to build that way. It’s not rocket science to obscure push notification data. Your beef should be with the app devs who don’t go the extra mile, not Apple.
  - withinboredom 3y ago
    If I sent a message to a group of friends, you don't need to know the contents if all you want to know is who my friends are. Just look for groups of people getting notifications at the same time. After a few messages, you'll know exactly who is in that group. I did some anonymization across hundreds of millions of users for some GDPR stuff a few years ago. If I knew when you made a purchase, to within a day, for two separate one-off purchases of our products ... I could deanonymize you. Specifically just you. If you had a subscription payment, and I knew at least one payment you were late on, and the hour you eventually paid it ... I could deanonymize you down to a group of 3-4 people. Correlation and timing are huge for deanonymizing things in otherwise anonymous data. We had to round our dates to the week to keep some of our analytical data anonymous.

harrygeez 3y ago

If every app need to poll different servers periodically or, listen for pushes, it will be a nightmare for battery life and be a big detriment to phone resource usage.

notsylver 3y ago
That shouldn't stop them from encrypting the contents and making it intentionally difficult to draw conclusions from?
- thfuran 3y ago
  You can draw plenty of conclusions from the metadata.
idle_zealot 3y ago
Sure, but shouldn't this be e2e encrypted? You could probably come up with a scheme such that Apple doesn't know the contents, sending app or recipient device.
- zarzavat 3y ago
  It should. I am sure that Apple will be working on this now. It’s unfortunate that they didn’t implement it before. Maybe Apple itself didn’t realise that this data was being taken by the authorities, and the parts of Apple that did know were not allowed to inform engineering.
- JimDabell 3y ago
  This is up to app developers to implement themselves. The mechanism Apple provides for this is UNNotificationServiceExtension, which allows an app to step in before a notification is delivered so that it can do things like decrypt it. https://developer.apple.com/documentation/usernotifications/unnotificationserviceextension https://developer.apple.com/documentation/usernotifications/...
  - cubefox 3y ago

vaxman 3y ago

Push is a just technique for minimizing (scarce wireless) bandwidth, battery and RAM consumption, which was critical in the mass deployment of the initial iPhone on AT&T. iPhone developers typically aren’t very skilled and they will stuff things into APNS payloads without thinking through the consequences (they’re just happy to get something working at all and more often than not, are in some remote country that doesn’t allow familiarizing with the user context) so this is definitely a privacy concern whether due to legal interception or hacking. Perhaps a future version of SwiftUI (and what Xcode Cloud may evolve into) will implement a simple E2E Push scheme by default, allowing Apple to spend more time reviewing the Push API use by the remaining legacy apps. But…take comfort in knowing that at least Apple’s server is not purposely located across national boundaries (like Blackberry). That’s good because users have no expectation of privacy from monitoring (by US government or otherwise) when using servers (or when they themselves are) on foreign soil. Meanwhile, US let 12,000 unknown persons literally wander across the border in just a single day last week (US can only handle 1,000 border crossers on a good day) and some are committing horrible crimes (https://foxsanantonio.com/amp/newsletter-daily/undocumented-migrant-charged-with-16-year-old-cheerleaders-murder-edna-texas-investigation-rangers-police-evidence https://foxsanantonio.com/amp/newsletter-daily/undocumented-...) —and yes, they do have Android and iPhones. The US is also sinking another $1T in (unfunded) debt every 90 days (meaning another Great Depression is not out of the question) and maybe it’s time to better focus our resources, for example, (after 40 years) China seems just about done surveying western IP and is clearly moving into a new era by having their massive APT groups (collectively 50x larger than US cyber forces) operate crude things like MoonBounce deployments —we have almost no monitoring for factory-installed threats, we’re totally wide open. https://youtu.be/j7OHG7tHrNM https://youtu.be/j7OHG7tHrNM