#Privacy: Facebook, TikTok, and Other Apps Use Push Notifications to Send Data about Your iPhone

This video sheds light on a growing practice among data-hungry apps where they use the background execution time allocated by iOS for the purpose of customizing notifications to send app analytics. Many apps do this. We just picked a few for this demo.

Apps on iOS don't run in the background. iOS doesn't allow apps to run in the background for a variety of reasons, mostly related to privacy and performance. Although iOS allows apps to run a few background tasks, access to background execution time is very restricted. But starting in iOS 10, iOS added a new feature to allow apps to customize push notifications even if they are not running. iOS wakes the app in the background when it receives a notification and allows the app a limited time to customize the notification before it is presented to the user. This includes decrypting an encrypted payload and downloading additional content to enrich the notification. Once the app hands in the customized notification to the system or the background time allocated runs out, the app is terminated.

This feature is now being widely used by data-hungry apps to send analytics during this background time. The analytics include unique signals about the user's device that allow for fingerprinting and tracking users across different apps developed by different developers. Apple does not allow fingerprinting. To counter fingerprinting, Apple is going to require developers to declare why their apps need access to required reason APIs, or APIs that provide signals commonly used for fingerprinting.

Chapters:

00:00 Introduction
01:44 TikTok
02:26 TikTok Uptime
02:42 Facebook
02:56 Facebook Uptime
03:29 X
04:08 X Uptime
04:23 LinkedIn
05:03 Bing
05:32 Final Words Peppered with Notifications

For more content like this, you can find us here:

#privacy #cybersecurity #iphone #iOS #security #infosec

A few links ..
Required Reason APIs:

Apple Notifications:

Notification Service Extension:

[origamipostit]

Thank you for these informative videos. I very much appreciate the work that goes into making these!

[laurenzvock]

Thank you so much for pointing this out. These kind of practices need to end.

[tdrg_]

0:34 For those curious. Apps have about 10 to 15 seconds before the device quits the subprocess and just shows the notification as it was received, no processing applied

[DarkShot-Media]

I love your channel, I’ve learned a lot of useful information from you. Keep up the good work!

[StefanAurori]

Nice work! What method are you using to bypass SSL Pinning?

[alex.figueroa]

Disabling the notifications prevents this from happening?

[Poppin]

In the end, you say Apple will soon do something about this. Did they provide a timeline as to when that may be?

[progenitor_amborella]

I’ve kept notifications turned off for a few years on any app that doesn’t need it for this reason. Would be interested to see how other mainstream apps like YouTube, Discord, Telegram, Snapchat, mail clients, etc behave.

[-anonim-]

Yep, you’re right! Good damn… Thanks for your work, you really a hero!

[xingyao]

You can turn off the push notifications

[sam.francis]

Loved the presentation except for the music.

[sam.francis]

Does blocking the notification, stop this?

[maltoNitho]

I’m literally turning off every notification. Unless it’s a person calling or texting me, eff em

[birn]

Does the App Privacy Report record any of this?

[noizz]

how much of these information do these apps already have after you installed and opened them once, seems like the only relevant tracking information is the boot time here, other device related information they already got it, no?

[aryalc.h.]

Is it true that iPhone users can now see if their contacts are ignoring their calls and messages? Example: iPhone user texts Android/iPhone user. Android/iPhone user doesn't respond, but Android/iPhone user continues to use other apps on their phone.

[pausmth]

I know it's been said, but, like make a freaking website and/or blog post for this. Just showing a bunch of text in a youtube video is painful. Also like seeing the full logs of the captures would be nice as well, with anything redacted that should be...

[Woedric]

I'm never installing a third party app again

[MariaGarcia-ynku]

What app are you using on the Mac to track the network traffic of the iPhone?

[YouTube_Nr.]

Would this data be linked to one’s account and as such technically be part of a GDPR request?