Hacker News Reader

Comment by VladVladikoff | Hacker News Reader

>The app does not collect or store any user data, which TechCrunch confirmed by analyzing the app’s network traffic as part of a test.

Actually pretty decent tech reporting if true. This is a non trivial task that can take some time to setup and analyze. If the app is secure and uses certificate pinning it would require reverse engineering it to patch over the pinning before you could MiTM the traffic and actually see it decrypted.

View on HN

Apple still has all the download and push notification data.

They can hand it over to the government real quickly.

The author does not provide a Android version and does not specify why.

Edit: ok, the author does specify why, see the replies below.

the author has specified why, in a pretty detailed post about it (https://www.iceblock.app/android). they quote your exact concern as the reason they only support Apple:

> Apple’s ecosystem allows for push notifications to be sent without requiring us to store any user-identifiable information.

edit: however, GrapheneOS disputes this: https://bsky.app/profile/grapheneos.org/post/3lswujex4e22w

iOS dev but not expert in how push notifications are implemented but confused by this claim, both platforms you need a device specific token because? of course you do? I feel like I am missing something

Right? I'm confused how APNS could do this differently from FCM. At least an Android app could implement push notifications without involving Google. This seems like a dev that doesn't really understand Android outside of the GMS features.

I checked and apparently, Apple supports broadcast channels for push. The app only stores the channel information and Apple stores the mapping of devices to channels. So while Apple still has the data, the dev does not.

Aha that makes some sense: https://developer.apple.com/documentation/usernotifications/... that is new with iOS 18, happy to be wrong, thanks for the follow up. Even less familiar with Android but assuming then the dev means you need a token at least currently to send a push through fcm and therefore could be compelled by law enforcement to give up the tokens. Apple of course could be compelled but that is a higher bar.

They do specify why: https://www.iceblock.app/android

They say they'd have to maintain a DB of device info and user accounts to send push notifications, whereas Apple devices do not require this.

Sadly they don't specify why that's not necessary with iOS, I'm so curious how that's any different. They need some ID to send push notifications, and Apple keeps those registered to devices for delivery. I don't get how that's any different from Firebase push notifications and wish they could actually explain that.

Android does not require this if the app developer instructs users to disable battery optimizations for the app so that it can poll for notifications itself.

I believe apple has only the metadata of the push notification, if implemented properly. The payload of the push notification itself can be end-to-end encrypted.

Isn't that true of any notification system? You're the one setting the payload, you can encrypt it before it gets to Google or Apple.

Yes, probably true. I only ever briefly interacted with APNS, can’t speak to firebase.

Reply on news.ycombinator.com