Originally Published 6 months ago — by Hacker News
Apple's Wallet ad controversy highlights ongoing issues with app store compliance and user trust, especially regarding push notification practices that often violate guidelines and erode user confidence, leading to frustration and calls for better notification management APIs.
Apple sent a promotional push notification about Fandango's discount for 'F1: The Movie' via the Wallet app to some iPhone users, causing complaints due to its intrusive nature and potential violation of Apple's guidelines, especially since users did not explicitly opt in for such marketing messages. An upcoming iOS 26 feature will allow users to opt in or out of promotional offers in the Wallet app, but current users on iOS 18 received the ad without explicit consent.
Apps like TikTok, Facebook, and others are using push notifications to scrape personal data from iPhones without user consent, potentially tracking user activities across iOS. The only known solution to stop this tracking is to disable push notifications for all apps, but this may come at the cost of missing important alerts. The security research duo Mysk has demonstrated how apps take advantage of a loophole in iOS push notifications to send data analytics to their servers, raising concerns about data privacy and security.
Security researcher Tommy Mysk has revealed that popular iPhone apps like TikTok, Facebook, Twitter, LinkedIn, and Bing are using push notifications to covertly send user data, exploiting a feature intended for notification customization. This practice allows apps to bypass iOS restrictions on background activities, potentially compromising user privacy. The data being sent includes unique device signals for fingerprinting and tracking users across different apps. Apple is taking steps to address this issue, including requiring developers to justify access to APIs often used for fingerprinting, in line with its efforts to strengthen user privacy.
Apple has updated its "Legal Process Guidelines" to acknowledge that government and law enforcement agencies can request push notification information. Previously, Apple and Google were unable to disclose this due to restrictions by the US government. However, a restriction was recently removed, allowing Apple to include this data in its transparency report. The next report, covering the second half of 2022, will provide details on government requests for customer data.
US Senator Ron Wyden has revealed that the US government and other foreign governments are tracking phone users through push notifications on Apple and Google devices. The information is sent to a server, which then sends out the notifications, potentially revealing location data. Wyden is calling for Apple and Google to be allowed to publicly discuss this surveillance practice and notify customers about demands for their data. Both companies have expressed their commitment to transparency in reporting these requests.
Apple has updated its Legal Process Guidelines to include its legal obligation to comply with law enforcement requests for Apple ID information associated with its push notification service. This comes after revelations that governments are using smartphone notification data for user surveillance. Apple and Google have confirmed that they have been subject to requests for user information related to push notifications from both foreign and U.S. government agencies. The data is being used to link anonymous users of messaging apps to specific Apple or Google accounts.
Unspecified governments have been requesting mobile push notification records from Apple and Google users, potentially allowing them to spy on individuals of interest, according to U.S. Senator Ron Wyden. Push notifications pass through the infrastructure of Apple and Google, giving the companies visibility into how their customers use apps and the ability to provide this information to governments. Both Apple and Google have confirmed receiving such requests, but the information about these practices is restricted from public release by the U.S. government, raising concerns about transparency. The U.S. is among the governments seeking notification data, and Apple and Google have been urged to disclose whether they facilitate this practice, publish aggregate statistics about demands received, and notify specific customers about data requests.
The US government and foreign law enforcement agencies can demand that Apple and Google share metadata associated with push notifications from apps on iOS and Android, according to court records and US Senator Ron Wyden. Push notifications can reveal which apps a person uses, providing information that may be relevant to law enforcement investigations. Law enforcement must first obtain the relevant push token from an app developer and then request information from Apple or Google to identify a person of interest. While the content of push notifications is not included in this information, additional requests could potentially provide access to specific push content. Apple has updated its transparency report to reflect government requests for push notification records, while Google includes these requests in its transparency reports.
U.S. Senator Ron Wyden has warned that foreign governments are spying on smartphone users by compelling Apple and Google to provide push notification records. These records, which include information about app usage and unencrypted text displayed in notifications, can be accessed by governments, both foreign and domestic. Wyden called for transparency from Apple and Google regarding the legal demands they receive, particularly from foreign governments. Both companies have expressed a commitment to keeping users informed about requests for push notification records.
Unidentified governments are using push notifications to surveil smartphone users by demanding data from Apple and Google, according to US Senator Ron Wyden. The traffic from apps that send push notifications puts the tech giants in a unique position to facilitate government surveillance of app usage. Apple has confirmed that it will update its transparency reporting to detail these types of requests. The data is used to link anonymous users of messaging apps to specific accounts, and while Apple advises developers not to include sensitive data in notifications, metadata is not encrypted, potentially compromising user privacy.
Unidentified governments are reportedly using push notifications from smartphone apps to surveil users, according to a letter from US Senator Ron Wyden to the Department of Justice. The letter suggests that foreign officials have been demanding data from Google and Apple, who handle the majority of push notifications. These notifications, which alert users to messages and updates, travel through the servers of these tech giants, giving them unique insight into user activity. Wyden has called for the repeal or modification of policies that hinder public discussions on push notification spying. Apple has stated that they will update their transparency reporting to include details on government requests related to push notifications. The Department of Justice has not commented on the matter.
Google Chrome for iOS now allows users to add web apps to their iPhone or iPad Home Screen, taking advantage of Apple's new capabilities for web apps introduced in iOS 16.4. This update allows users to save their favorite websites for quick access without leaving Chrome and using Safari. Web apps added to the Home Screen can be opened and used like regular apps, with the ability to receive push notifications. Apple's efforts to embrace web apps may be a response to accusations of anti-competitive practices regarding the App Store.
Push notifications have become a defining feature of smartphones and modern life, with the average user receiving around 50 to 80 notifications per day. While businesses must obtain written consent before sending promotional text messages, push notifications are not regulated in the same way. App makers are allowed to use alerts as they see fit, and once users opt-in, they may receive any or all notifications, whether functional or promotional. While Apple and Google provide controls to revoke an app's permission to send notifications, finding and adjusting these settings can be a frustrating and time-consuming process. The problem of spammy push notifications could be solved by regulators or by Apple and Google implementing a menu that lets users choose which notifications they want to receive upfront.
Microsoft is introducing a number-matching feature in its Authenticator app to combat MFA fatigue, a social engineering tactic that overwhelms users with push notifications asking for login approval. The feature adds a one-time code element to the push notification approach, requiring users to enter another number to complete the login process. The number matching feature will be automatically enabled for all push notifications in Authenticator, and users will not be able to opt out of the feature. The change will be deployed starting this week.