Hacker News Reader

Comment by JustSomeNobody | Hacker News Reader

Re: Google Play Services. Here's is the way I understand this to work, so please do correct me if I'm wrong.

Signal uses Google Play Services to notify me that I have an incoming message from Signal. The Signal app is then woken up and the signal app then retrieves my (encrypted) message. So, therefore, the only thing Google knows is that I received a Signal message, what time and if I have location services on, where I was at the time, yes?

On iOS, how is this any different? If I get a notification, iOS knows I got a notification from signal, when and where i was at if Location is turned on.

What am I missing?

Note: I _don't_ like that either system has that much meta data about my conversations available to them, but I don't see how one is better than the other, here.

View on HN

> Re: Google Play Services. Here's is the way I understand this to work, so please do correct me if I'm wrong.

> Signal uses Google Play Services to notify me that I have an incoming message from Signal.

More importantly:

a. That dependency, along with other "restrictions", sets an artificially high barrier to actually using the product independently. This is presumably so that they can maintain the pretence of being "open source".

b. Keep track of application downloads and whatever else Google provides to developers.

Moreover, as the paper that someone has linked elsewhere says, if you are allowing Google services in your app (Google Cloud Messaging, to be exact), you're at the mercy of anyone with control of it. A relatively trivial attack via GCM, as the paper hints, would involve simply replacing your application with a backdoored version, and you'd be none the wiser. It is a massive attack surface that just cannot be ignored.

> So, therefore, the only thing Google knows is that I received a Signal message, what time and if I have location services on, where I was at the time, yes?

Considering that Signal compiles code from Google into their app, there’s an actual issue there: the Google code could just intercept and take control of any of the messages. And there’s a lot of code from Google in there that no one has audited yet.

What about on iOS? Couldn't the libraries that are used on iOS do the same?

The metadata is considered super important in modern surveillance. Your receipt can be correlated with a sender for example, over the course of many messages. Now they can start on a network analysis, start correlating with other people or events etc...

Oh, yes, I understand this. I don't understand how it is different for iOS than Android. Sorry if my initial post was not clear on that.

Reply on news.ycombinator.com