How Apps Use Push Notifications to Spy on You (and How to Stop Them)

How Apps Use Push Notifications to Spy on You (and How to Stop Them)

Back in December, we learned that governments and law enforcement agencies are able to spy on your smartphone activity by requesting your push notification data from Apple or Google. Very cool and unconcerning! But as it turns out, it's not just the authorities who can scrape your push notification data: Apps do it too, without you ever opening said app in the first place. But you can put a stop to it.

How apps spy on you through your push notifications

As security research duo Mysk explains in this video, apps are taking advantage of a loophole in iOS push notifications to scrape personal data on your iPhone and send it back to remote servers. Here how it works: iOS allows apps to wake in the background when push notifications come through in order to allow the app to decrypt the payload (the message contained in the notification), or download data attached to the alert. But according to Mysk, many "data-hungry" apps use this as an opportunity to send data analytics to their servers, rather than just make network calls to customize the notification, as would reportedly be expected.

Aside from being a sketchy practice, this abuse of push notification downtime can actually be used to "fingerprint" (that is, track) users. Mysk demonstrates how when a TikTok notification comes through, the app immediately sends off data analytics. When Mysk clears the notification, TikTok sends more data, including system uptime (how long iOS has been up and running on your iPhone). That means TikTok can see how long it's been since you restarted your iPhone, even though you never actually opened the app.

Something similar happens with Facebook, X, LinkedIn, and Bing notifications: When Mysk clears these alerts, the app scrape the iPhone's uptime, in addition to other device information. As explained in a post on X, other device data includes locale (your device's language settings), keyboard language, available memory, battery status, device model, and display brightness, among others. Theoretically, Mysk says, this data can be used to track a user's activities across iOS without you ever actually opening the app involved.

How to stop apps from tracking your activity through push notifications

At this time, the only known solution is the most obvious: disable push notifications for all apps. It's the same solution we offerd when we learned law enforcement agencies and governments are able to request user push notification data from Apple and Google: simply cut off access to the data these companies want so badly.

Of course, that's easier said than done. Notifications can be useful, especially with messaging apps that let you know when a new text has come through. Disabling push notifications for these apps puts you at risk of falling far behind in group threads and personal chats, which defeats much of the purpose of carrying a smartphone in the first place.

That means it's really up to you: what level of data tracking can you tolerate? My recommendation is to disable notifications for any and every app you can afford to. I keep Snapchat notifications turned off at all times, for example, because I'm fine manually checking the app for new snaps (an added benefit: I cannot stand the obnoxious and irrelevant notifications Snapchat loves to spam me with, and no I don't get them). I keep notifications enabled for my messaging apps, because even if Meta is scraping my data, I don't want to miss new alerts from friends and family.

Hopefully Apple will address this privacy and security flaw soon, and block apps from being able to leach this information whenever a push notification comes through. Until then, our only option is to block these apps from alerting us at all.



* This article was originally published here

Comments

Post a Comment

Popular posts from this blog

How to Download All Your Media From Google Photos

Image
Cloud storage has changed the way we take care of our data. In the past, you needed to backup and transfer files between devices directly, or else you wouldn't have them in multiple locations. If you took photos on your iPhone or Android, for example, you'd often want to plug it into your computer to make sure those photos were both backed up and easily accessible for sharing with friends, family, and the internet at large. The problem is, we've changed the way we deal with data these days. If you plug your smartphone into your computer expecting to transfer all the photos and videos you see in your photos app of choice, you might be surprised to find that only a fraction of the images actually make their way to your PC. It's confusing, considering that media is accessible on the phone: Why can it just be a seamless transfer? Google Photos makes it confusing to know which images are stored on-device That's exactly what happened with Reddit user Spax123 , who took
Read more

The Best U.S. Cities for Tech Jobs (Aside From the Obvious)

Image
Working in tech no longer means having to live in one of a handful of increasingly unaffordable cities, like New York City, Seattle, Chicago, and San Francisco. Instead, as jobs involving artificial intelligence and product security, among other areas, continue to grow, cities that weren't previously considered tech hubs now offer opportunities for both tech-related employment and affordable living. Here are a few examples, compiled using data from job market reports and cities, as well as input from tech recruiters and hiring managers. Bentonville, Arkansas Perhaps best known for being Walmart's home city, Bentonville has been on the rise as a tech center for the last seven or eight years, according to Eóin O'Toole, a tech recruiter and managing partner at Riviera Partners . In addition to the big-box store giant, O'Toole says that there's a "surging ecosystem both directly and indirectly related to Walmart," as well as other major employers, like JB H
Read more

How to Choose Between Alexa and Google Assistant

Image
If you’re looking to have a hands-free experience with your smart home, you need a voice assistant. By merely talking in the direction of a device enabled with the assistant, you can get information about the weather, time, local businesses, or anything else from their knowledgbase. You can control smart devices or send an email or SMS, and it’s all done by interacting vocally with the assistant, who speaks in a human-ish way. There are three well-known voice assistants: Siri, which is exclusive to Apple devices, Alexa , which is operated by Amazon, and Google Assistant . Since people are generally Apple or Android loyalists , it makes sense that if you run Apple products, you’d stick with Siri for your assistant. For everyone else, which voice assistant should you choose: Alexa or Google?  When it comes to smart home technology, there are two factors to consider: the hub you’ll use to connect your smart devices so you can control them, and what voice assistants you might want to use
Read more