Mastodawn

Kevin Beaumont Sep 14, 2025

For privacy researchers, this thread is interesting. iOS allow apps to make network requests after push notifications.

Instagram (and others) appear to be using this to profile devices, eg retrieve device uptime without their customer opening Instagram.

This one probably needs more eyes on it. https://mastodon.social/@mysk/115204746326765802

Show thread

j-r conlin

@GossiTheDog

Sigh...

I'm going to guess that this is APNs, but betting the same problem exists for FCM and WebPush. Even ServiceWorker threads have some small autonomy about the sort of things that they can do, and the FetchAPI is available, so URL loading is definitely "a thing".

This is why we can't have nice things.