7 ms·

iPhone apps harvest data when they send you notifications, researchers find

93 points by santaz01 3y ago

bell-cot 3y ago
"But all my friends are using $App, and ..." "But $App is free, and it's so cool, and ..." "Who cares? That's how the world works now." Etc.
- A4ET8a8uTh0 3y ago
  I know this is not how the comment is originally intended, but I am slowly starting to throw in the towel with regards to trying to convincing others. Best I can do is my immediate family. I don't even dream about my social circles anymore. I just want a relatively safe digital space for my family.
  - cqqxo4zV46cp 3y ago
    Okay. This is very realistically your hobby horse, and you aren’t respecting that people might want a relationship with you without you lecturing them about this thing that you just care a lot more about than they do. I don’t think that people should be lining up to show sympathy in this scenario.
    - A4ET8a8uTh0 3y ago
      I am not looking for sympathy. Everyone is advocating for their favored position all the time. X good. Y is bad. We should do Z. We shouldn't do W. Why is my position so much different than everyone else's? The question is whether I am able to convince anyone, but that is a separate part. I assume since you used word 'lecture', you are not convinced it is an issue worth discussing among your family, friends and peers? edit: I thought a little more about what you wrote in: 'people might want a relationship with you without you lecturing them' I am starting to wonder. Should humans have EULAs?
- bdcravens 3y ago
  25 years ago everyone was singing the praises about Google the search engine, and then a few years later, Gmail. At one point you'd see Ad Sense on many tech blogs. The phenomenon you describe is hardly new, it's just easier.
deleted 3y ago
[deleted]
vdaea 3y ago
The article is absolutely all over the place. The gist of it is that apps are allowed to run a bit of code when they receive a notification and they can use that bit of code to send some telemetry back to the mothership.
- scarface_74 3y ago
  And the craziest part is > What many people don’t realize is that targeted advertising and other invasions of digital privacy are all about figuring out your identity. And then they interviewed Facebook and LinkedIn. They already know who you are. Facebook knows a lot more about you because of what people voluntarily tell them about your personal life and LinkedIn already knows everything about your professional life. As often as people tag exactly where they are real time in posts, it seems unnecessary to gather more information via IP addresses.
zadokshi 3y ago
Not saying some companies aren’t up to no-good. But, collecting timezone (or ip to infer timezone), as long as it’s done with user consent in the privacy policy and or notifications setup process is actually helpful for end users. Most of us want (for example) our exercise reminder or our news update to arrive at breakfast even when we travel across Timezone boundaries. I don’t want to have to sign in to an app or go to a settings page for an app to tell it when I cross Timezone boundaries. If apps are collecting info to allow inferring Timezone without user consent then thats a different kettle of fish. Not that I ever want linked in notifications, I definitely don’t want linked in notifications at 3am in the morning because I crossed a few international date lines.
- NotYourLawyer 3y ago
  Not clear why the app needs location info for this. Notifications should just be relative to the current local time.
  - zadokshi 3y ago
    Spoken like someone who has never implemented a push notification system. How does a server know when to send a push notification to a client if the server doesn’t know the users local Timezone. Want a wake up call at 7am? How does the server know when to make the call? Want to avoid sending a study reminder at 3am, how does the server know when it is 3am? Most websites do some kind of location detection to show times back to the user that are likely in their current Timezone.
    - NotYourLawyer 3y ago
      Oops good point.
- latexr 3y ago
  > as long as it’s done with user consent in the privacy policy No one¹ reads those. I wouldn’t consider that informed consent. ¹ Not literally. I read them but personally know no one else who does.
drewg123 3y ago
How much information do app devs get when customers disable app notifications from their app entirely? Some apps (especially food delivery.. doordash, i'm looking at you) have such spammy notifications, I tend to disable notifications from the app entirely unless I'm actively using it (eg, an order is pending).
- function_seven 3y ago
  My feature request for iOS: Allow me to disable notifications from an app unless I have opened it within the last X hours. I’d set it to a couple hours. My food apps could then tell me the order is ready, but can’t spam me with “Special Offers For You” days later. Maybe I can do this with an automation?
  - fennecfoxy 3y ago
    Or just fix the root problem so that the notification is just a notification and not a way to harvest data, I guess.
  - ubermonkey 3y ago
    I'd LOVE this. I also want something else that I wonder if I could dummy up myself. I want to change certain phone behaviors based on whether or not a given Bluetooth device is connected. My use case is "when I'm on my motorcycle, connected to headset audio, I want (a) the phone to read me texts and (b) to turn on navigation audio." I do not want either of these things UNLESS I'm on the motorcycle with the Cardo turned on.
    - acosmism 3y ago
      it might be possible to get this together using apple's "shortcuts" app
      - ubermonkey 3y ago
        No hooks for what I want there, sadly.
krono 3y ago
You'd think opting out of sharing analytics data with app developers would also cover push notification metrics but it doesn't seem to be that way from a quick look over the official docs. https://developer.apple.com/notifications/push-notifications-console/ https://developer.apple.com/notifications/push-notifications...
ubermonkey 3y ago
Yet another reason to deny notification rights to pretty much everything nonnative, and to restrict the native stuff. I mean, first, they're disruptive. You don't need to know every time you get an email. Even on my laptop, I only get an email ding if it's from (a) a coworker (and it's a small company) or (b) my wife. Second, the notification-spam ship has sailed. Apps behave TERRIBLY and abuse the privilege. DoorDash, for example, will spam you with ads using notifications if you turn it on. As a consequence, I just watch the app itself when food delivery is pending -- and so no notifications are required.
- bdcravens 3y ago
  That's why I'm pretty aggressive about white-listing my notifications. Apple would do well to make this the default. The default answer is that they wouldn't for financial reasons, but over the past few years, I've been pleasantly surprised by changes they've implemented that I thought weren't in their best interests for those same reasons.
wackget 3y ago
How much data is Gizmodo harvesting from you when you read this article? uBlock Origin shows 16 domains connected; most of them loading JavaScript. The real number is probably far higher when no ad-blocker is used.
- saintfire 3y ago
  This is how I feel every time I see any mainstream news outlet copy-pasting any privacy related piece. All the outrage companies and people have is posturing in almost every case, in my opinion.
  - barrysteve 3y ago
    You want to push it, until we are forced to return the favour? When one side doesn't listen, then these conversations are nonsense. The concept of having a conversation is coming to a close.
- cqqxo4zV46cp 3y ago
  And you’re on a VC company’s advertising “social network”. Whataboutism does nobody any good.
  - edgyquant 3y ago
    HN is not a social network
    - ale42 3y ago
      And it loads zero trackers. Zero external domains contacted, also.
- lxgr 3y ago
  I’m not usually reading a Gizmodo article with my screen locked and my phone in my pocket as I walk around the city, with the article able to determine (at a minimum) my IP address, which can tell them whether I’m at home, work, the mall, or the doctor etc.
jbverschoor 3y ago
Back in '12 we wanted to know if people uninstalled an app, so we sent a quiet push notification every night. At least back then it didn't turn up on the phone if the text was empty or something.
- plagiarist 3y ago
  That still happens to this day, one can send both silent and alerting push.
bushbaba 3y ago
Ssh stop telling the world about the adtech data collection tricks. In all honesty this is just one of the many ways companies feed the ads monster. coal is to steam train as user data to adtech.
- Yhippa 3y ago
  Maybe you might know. I assume most webpages and native apps are harvesting all data available that they can get their hands on that the users/OS will let them take and then selling that off to the highest bidder. Including information that is completely unrelated to the operation of the application. Seems like you can make correlations with almost any type of data these days so I imagine even things that seem useless to capture could be valuable in the future.
bluetidepro 3y ago
> For example, the tests showed that when you interact with a notification from Facebook, the app collects IP addresses, the number of milliseconds since your phone was restarted, the amount of free memory space on your phone, and a host of other details. I feel like "...when you interact..." is a very key part of this. If I understand it correctly, that to me really makes the headline seem less bad. So if you just delete the notification and never tap it, do they not get any data? That part is unclear but very important to this context.
asylteltine 3y ago
This is why websites push you to apps. Venmo recently stopped me from transferring money using web even though it worked just fine a month ago!
duxup 3y ago
This whole article is kinda weird. These are apps that already are installed, the user chose to get notifications ... yes so when the notification runs the app runs and some telemetry is collected. Cat is out of the bag already. I'm concerned about this whole topic too but man that article is hard to read and really just kinda states the obvious. Why it is focused on notifications is sort of beyond me. There's nothing presented to say that users don't know that the notification from the app is ... the app. It also seems like you have to interact with the notification for any of this to happen. That's not surprising as that usually leads to the app that you already have / know is there and so on, and now you interacted and opened the app. If you're opening facebook notifications, you have facebook installed, you likely logged in ... so yes there's tracking going on. Article seems to imply this is some extra level sneaky way for apps to collect data but it doesn't seem to be that way anyway.
- tremarley 3y ago
  The problem is, people who care about their privacy do not want to be tracked when they’re not using the app. But if an institution wants to find out what devices subscribe to certain groups or pages They could correspond the times that a pages media posts, with the times a range of devices received a notification from specific apps. It’s that easy
sxp 3y ago
The even more significant bit is that governments can track users this way without standard warrants: https://www.washingtonpost.com/technology/2023/12/06/push-notifications-surveillance-apple-google/ https://www.washingtonpost.com/technology/2023/12/06/push-no... It's unclear what data the government tracks, but it's annoying that Apple allows such a trivial security hole when they keep bragging about "privacy".
- tremarley 3y ago
  The “privacy” brag is just a successful marketing campaign.
- saurik 3y ago
  I think it is also worth noting that Apple goes out of their way to prevent developers--both technologically and contractually/procedurally--from building alternatives even for privacy-focused applications.
1vuio0pswjnm7 3y ago
"This isn't the first time Mysk's tests have uncovered data problems at Apple, which has spent untold millions convincing the world that "what happens on your iPhone, stays on your iPhone."" The safest "app store" would be one where all "apps" must be open sourced so that, optionally, if a customer dislikes a certain "feature" or other behaviour of the software, she can remove it from the source and compile her own version. Additonally, the customer could add "missing features". As it stands owners of Apple computers have no control over anything really . They delegate all of it to Apple. That is why every thread about these issues includes futile pleas to Apple. (That will go unaswered.) There is no DIY. That would be "unsafe" according to Apple's media spin. Perhaps the closest we have to an "open" app store is f-droid.org. https://world.hey.com/dhh/apple-s-new-extortion-regime-to-keep-big-app-makers-d4d03ea9 https://world.hey.com/dhh/apple-s-new-extortion-regime-to-ke...

93 points by santaz01 3y ago

"But all my friends are using $App, and ..." "But $App is free, and it's so cool, and ..." "Who cares? That's how the world works now." Etc.

A4ET8a8uTh0 3y ago
I know this is not how the comment is originally intended, but I am slowly starting to throw in the towel with regards to trying to convincing others. Best I can do is my immediate family. I don't even dream about my social circles anymore. I just want a relatively safe digital space for my family.
- cqqxo4zV46cp 3y ago
  Okay. This is very realistically your hobby horse, and you aren’t respecting that people might want a relationship with you without you lecturing them about this thing that you just care a lot more about than they do. I don’t think that people should be lining up to show sympathy in this scenario.
  - A4ET8a8uTh0 3y ago
    I am not looking for sympathy. Everyone is advocating for their favored position all the time. X good. Y is bad. We should do Z. We shouldn't do W. Why is my position so much different than everyone else's? The question is whether I am able to convince anyone, but that is a separate part. I assume since you used word 'lecture', you are not convinced it is an issue worth discussing among your family, friends and peers? edit: I thought a little more about what you wrote in: 'people might want a relationship with you without you lecturing them' I am starting to wonder. Should humans have EULAs?
bdcravens 3y ago
25 years ago everyone was singing the praises about Google the search engine, and then a few years later, Gmail. At one point you'd see Ad Sense on many tech blogs. The phenomenon you describe is hardly new, it's just easier.

deleted 3y ago

[deleted]

vdaea 3y ago

The article is absolutely all over the place. The gist of it is that apps are allowed to run a bit of code when they receive a notification and they can use that bit of code to send some telemetry back to the mothership.

scarface_74 3y ago
And the craziest part is > What many people don’t realize is that targeted advertising and other invasions of digital privacy are all about figuring out your identity. And then they interviewed Facebook and LinkedIn. They already know who you are. Facebook knows a lot more about you because of what people voluntarily tell them about your personal life and LinkedIn already knows everything about your professional life. As often as people tag exactly where they are real time in posts, it seems unnecessary to gather more information via IP addresses.

zadokshi 3y ago

Not saying some companies aren’t up to no-good. But, collecting timezone (or ip to infer timezone), as long as it’s done with user consent in the privacy policy and or notifications setup process is actually helpful for end users. Most of us want (for example) our exercise reminder or our news update to arrive at breakfast even when we travel across Timezone boundaries. I don’t want to have to sign in to an app or go to a settings page for an app to tell it when I cross Timezone boundaries. If apps are collecting info to allow inferring Timezone without user consent then thats a different kettle of fish. Not that I ever want linked in notifications, I definitely don’t want linked in notifications at 3am in the morning because I crossed a few international date lines.

NotYourLawyer 3y ago
Not clear why the app needs location info for this. Notifications should just be relative to the current local time.
- zadokshi 3y ago
  Spoken like someone who has never implemented a push notification system. How does a server know when to send a push notification to a client if the server doesn’t know the users local Timezone. Want a wake up call at 7am? How does the server know when to make the call? Want to avoid sending a study reminder at 3am, how does the server know when it is 3am? Most websites do some kind of location detection to show times back to the user that are likely in their current Timezone.
  - NotYourLawyer 3y ago
    Oops good point.
latexr 3y ago
> as long as it’s done with user consent in the privacy policy No one¹ reads those. I wouldn’t consider that informed consent. ¹ Not literally. I read them but personally know no one else who does.

drewg123 3y ago

How much information do app devs get when customers disable app notifications from their app entirely? Some apps (especially food delivery.. doordash, i'm looking at you) have such spammy notifications, I tend to disable notifications from the app entirely unless I'm actively using it (eg, an order is pending).

function_seven 3y ago
My feature request for iOS: Allow me to disable notifications from an app unless I have opened it within the last X hours. I’d set it to a couple hours. My food apps could then tell me the order is ready, but can’t spam me with “Special Offers For You” days later. Maybe I can do this with an automation?
- fennecfoxy 3y ago
  Or just fix the root problem so that the notification is just a notification and not a way to harvest data, I guess.
- ubermonkey 3y ago
  I'd LOVE this. I also want something else that I wonder if I could dummy up myself. I want to change certain phone behaviors based on whether or not a given Bluetooth device is connected. My use case is "when I'm on my motorcycle, connected to headset audio, I want (a) the phone to read me texts and (b) to turn on navigation audio." I do not want either of these things UNLESS I'm on the motorcycle with the Cardo turned on.
  - acosmism 3y ago
    it might be possible to get this together using apple's "shortcuts" app
    - ubermonkey 3y ago
      No hooks for what I want there, sadly.

krono 3y ago

You'd think opting out of sharing analytics data with app developers would also cover push notification metrics but it doesn't seem to be that way from a quick look over the official docs. https://developer.apple.com/notifications/push-notifications-console/ https://developer.apple.com/notifications/push-notifications...

ubermonkey 3y ago

Yet another reason to deny notification rights to pretty much everything nonnative, and to restrict the native stuff. I mean, first, they're disruptive. You don't need to know every time you get an email. Even on my laptop, I only get an email ding if it's from (a) a coworker (and it's a small company) or (b) my wife. Second, the notification-spam ship has sailed. Apps behave TERRIBLY and abuse the privilege. DoorDash, for example, will spam you with ads using notifications if you turn it on. As a consequence, I just watch the app itself when food delivery is pending -- and so no notifications are required.

bdcravens 3y ago
That's why I'm pretty aggressive about white-listing my notifications. Apple would do well to make this the default. The default answer is that they wouldn't for financial reasons, but over the past few years, I've been pleasantly surprised by changes they've implemented that I thought weren't in their best interests for those same reasons.

wackget 3y ago

How much data is Gizmodo harvesting from you when you read this article? uBlock Origin shows 16 domains connected; most of them loading JavaScript. The real number is probably far higher when no ad-blocker is used.

saintfire 3y ago
This is how I feel every time I see any mainstream news outlet copy-pasting any privacy related piece. All the outrage companies and people have is posturing in almost every case, in my opinion.
- barrysteve 3y ago
  You want to push it, until we are forced to return the favour? When one side doesn't listen, then these conversations are nonsense. The concept of having a conversation is coming to a close.
cqqxo4zV46cp 3y ago
And you’re on a VC company’s advertising “social network”. Whataboutism does nobody any good.
- edgyquant 3y ago
  HN is not a social network
  - ale42 3y ago
    And it loads zero trackers. Zero external domains contacted, also.
lxgr 3y ago
I’m not usually reading a Gizmodo article with my screen locked and my phone in my pocket as I walk around the city, with the article able to determine (at a minimum) my IP address, which can tell them whether I’m at home, work, the mall, or the doctor etc.

jbverschoor 3y ago

Back in '12 we wanted to know if people uninstalled an app, so we sent a quiet push notification every night. At least back then it didn't turn up on the phone if the text was empty or something.

plagiarist 3y ago
That still happens to this day, one can send both silent and alerting push.

bushbaba 3y ago

Ssh stop telling the world about the adtech data collection tricks. In all honesty this is just one of the many ways companies feed the ads monster. coal is to steam train as user data to adtech.

Yhippa 3y ago
Maybe you might know. I assume most webpages and native apps are harvesting all data available that they can get their hands on that the users/OS will let them take and then selling that off to the highest bidder. Including information that is completely unrelated to the operation of the application. Seems like you can make correlations with almost any type of data these days so I imagine even things that seem useless to capture could be valuable in the future.

bluetidepro 3y ago

> For example, the tests showed that when you interact with a notification from Facebook, the app collects IP addresses, the number of milliseconds since your phone was restarted, the amount of free memory space on your phone, and a host of other details. I feel like "...when you interact..." is a very key part of this. If I understand it correctly, that to me really makes the headline seem less bad. So if you just delete the notification and never tap it, do they not get any data? That part is unclear but very important to this context.

asylteltine 3y ago

This is why websites push you to apps. Venmo recently stopped me from transferring money using web even though it worked just fine a month ago!

duxup 3y ago

This whole article is kinda weird. These are apps that already are installed, the user chose to get notifications ... yes so when the notification runs the app runs and some telemetry is collected. Cat is out of the bag already. I'm concerned about this whole topic too but man that article is hard to read and really just kinda states the obvious. Why it is focused on notifications is sort of beyond me. There's nothing presented to say that users don't know that the notification from the app is ... the app. It also seems like you have to interact with the notification for any of this to happen. That's not surprising as that usually leads to the app that you already have / know is there and so on, and now you interacted and opened the app. If you're opening facebook notifications, you have facebook installed, you likely logged in ... so yes there's tracking going on. Article seems to imply this is some extra level sneaky way for apps to collect data but it doesn't seem to be that way anyway.

tremarley 3y ago
The problem is, people who care about their privacy do not want to be tracked when they’re not using the app. But if an institution wants to find out what devices subscribe to certain groups or pages They could correspond the times that a pages media posts, with the times a range of devices received a notification from specific apps. It’s that easy

sxp 3y ago

The even more significant bit is that governments can track users this way without standard warrants: https://www.washingtonpost.com/technology/2023/12/06/push-notifications-surveillance-apple-google/ https://www.washingtonpost.com/technology/2023/12/06/push-no... It's unclear what data the government tracks, but it's annoying that Apple allows such a trivial security hole when they keep bragging about "privacy".

tremarley 3y ago
The “privacy” brag is just a successful marketing campaign.
saurik 3y ago
I think it is also worth noting that Apple goes out of their way to prevent developers--both technologically and contractually/procedurally--from building alternatives even for privacy-focused applications.

1vuio0pswjnm7 3y ago

"This isn't the first time Mysk's tests have uncovered data problems at Apple, which has spent untold millions convincing the world that "what happens on your iPhone, stays on your iPhone."" The safest "app store" would be one where all "apps" must be open sourced so that, optionally, if a customer dislikes a certain "feature" or other behaviour of the software, she can remove it from the source and compile her own version. Additonally, the customer could add "missing features". As it stands owners of Apple computers have no control over anything really . They delegate all of it to Apple. That is why every thread about these issues includes futile pleas to Apple. (That will go unaswered.) There is no DIY. That would be "unsafe" according to Apple's media spin. Perhaps the closest we have to an "open" app store is f-droid.org. https://world.hey.com/dhh/apple-s-new-extortion-regime-to-keep-big-app-makers-d4d03ea9 https://world.hey.com/dhh/apple-s-new-extortion-regime-to-ke...