https://www.iceblock.app/android
(Concerned that the information they would be required to store and handle may require they work with the government during a subpoena)
Apple also has to handle this (internally) to do push notifications, but I suppose that theory is Apple has pockets to fight the government (or it's at least out of the developers hands)
There is an argument to be made that Apple is better positioned to fight financially... However, the current administration tends to threaten blocking or mergers/acquisitions, or other red tape unless they comply. I doubt Apple would accept such financially damaging threats to protect ICEBlock's users.
(Personally, I am suspecting that they do try much more than some other companies, but again, the opacity makes it impossible to verify.)
Apple has since confirmed in a statement provided to Ars that the US federal government "prohibited" the company "from sharing any information," but now that Wyden has outed the feds, Apple has updated its transparency reporting and will "detail these kinds of requests" in a separate section on push notifications in its next report.
On the other hand, Google isn't exactly working with the authorities either. They moved Google Maps' location history to on-device storage because of the many warrants they were served, for instance, and they too refuse to decrypt phones.
These companies know to pick their battles, but they did take on the government various times.
This is untrue at some technical level: Apple is currently unable to break AES-256.
The San Bernadino case was about having Apple create and sign new firmware that would enable a brute force attack - which could easily be unsuccessful. I don't believe the Secure Enclave found in newer models even allows for a brute force attack (enforcing some delay, among other things) from BFU state.
As a side note, they do fight sometimes, they fought the EU's DMA for example, but in Russia and China, they complied without a fight though to my knowledge.
See? No laws broken, perfectly safe.
A. Sideload an app so that google play store doesn't know you've installed it.
B: Run periodic background tasks to poll any https endpoint so no service provider has logs of device ids for push notifications.
C: Create local notifications on the device.
Someone explain to him that whatever he is doing, he needs to end to end encrypt so none of the infrastructure or middlemen can see anything but ips and who installed it (until they control the end device). (Better yet use veilid if it works yet, or i think there is some kind of tor routing over http these days)
Also he is making a weird mistake by not being a website instead of obvious corporate controlled "app", also should have tried harder to keep anonymous
I know it's possible to do push notifications without user accounts - I'm doing that in an app I maintain.
But it is tedious to publish Android apps with a personal developer account - you need to run a 2 week test with 12 (used to be 20) users before you can release the app.
What prevents law enforcement for ordering the developer to alter the application in a way that reveals user info, maybe the order is simply that they have to hand over their signing certificates for the app?
Also, as an offside, this is one of the things I hate about Google's handling of AOSP: they keep shuttling things into their proprietary layer, making it next to impossible for alternative approaches to gain traction.
and they can make their own push system so that claim doesn't hold water?
I don't really see their point about device IDs, though. There are ways around that, from cryptography to on-device filtering.
It's also not like Apple isn't storing device IDs to send these push messages. There's no difference to user privacy.
All of that said, by leaving it up to Apple to keep track of device IDs, they're not going to be on the hook for warrants. The government can get that data from Apple instead, but they can claim innocence. It's CYA.
Apple could be subpoenaed for the data, and we all know that Tim Apple is happy to jump when Trump says jump.
Meanwhile on Android they could easily just distribute the app from their own website and if they really insist on push messages there are plenty of non-google options that are actually private.