4 ms·

Notifications generally go through Google Firebase so by not running private messages through firebase they avoid potential leaks. At least that's my guess

kzrdude 3y ago
That sounds pretty bad, a cloud service needs to see all notifications?
- miohtama 3y ago
  A good question. I am not sure if notifications on iOS, Android, Google Chrome or Firefox are end-to-end encrypted.
  - nickphx 3y ago
    You can send whatever values you desire as long as your service worker handles it.
- kube-system 3y ago
  Server side push messaging uses cloud infrastructure on both Android and iOS devices. Some applications choose to make these notifications more 'secure' by not sending any content through them, just the fact that you have a new notification, but that makes the UX a little less friendly. https://en.wikipedia.org/wiki/Apple_Push_Notification_service https://en.wikipedia.org/wiki/Apple_Push_Notification_servic... https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging
- keep_reading 3y ago
  No, it can be encrypted and then you have a hook that decrypts the notification on-device. On iOS you need to get approval from Apple to do this though
daveoc64 3y ago
A common way around this is to simply send a notification through Firebase/other push notification mechanism that tells the app there is a new message. The app can then retrieve the message and decrypt it. Most of them will then update the notification shown to the user with the full message content.
- tux3 3y ago
  Maybe the concern is that Firebase still learns that user A and user B receive notifications back and forth at around the same time, interspersed with periods of no notifications for both If A and B talk regularly, there might not be many other C who by coincidence exchange notifications at the same time So you might be vulnerable to a sort of traffic analysis

kzrdude 3y ago

That sounds pretty bad, a cloud service needs to see all notifications?

miohtama 3y ago
A good question. I am not sure if notifications on iOS, Android, Google Chrome or Firefox are end-to-end encrypted.
- nickphx 3y ago
  You can send whatever values you desire as long as your service worker handles it.
kube-system 3y ago
Server side push messaging uses cloud infrastructure on both Android and iOS devices. Some applications choose to make these notifications more 'secure' by not sending any content through them, just the fact that you have a new notification, but that makes the UX a little less friendly. https://en.wikipedia.org/wiki/Apple_Push_Notification_service https://en.wikipedia.org/wiki/Apple_Push_Notification_servic... https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging
keep_reading 3y ago
No, it can be encrypted and then you have a hook that decrypts the notification on-device. On iOS you need to get approval from Apple to do this though

daveoc64 3y ago

A common way around this is to simply send a notification through Firebase/other push notification mechanism that tells the app there is a new message. The app can then retrieve the message and decrypt it. Most of them will then update the notification shown to the user with the full message content.

tux3 3y ago
Maybe the concern is that Firebase still learns that user A and user B receive notifications back and forth at around the same time, interspersed with periods of no notifications for both If A and B talk regularly, there might not be many other C who by coincidence exchange notifications at the same time So you might be vulnerable to a sort of traffic analysis