4 ms·

I'm surprised hyper-private services like Signal haven't foreseen this as a potential vector and given you options to eg. exclude different details from push no

I'm surprised hyper-private services like Signal haven't foreseen this as a potential vector and given you options to eg. exclude different details from push notifications (or warned you to disable them altogether if you're worried about it)

Klonoar 3y ago
Unless my memory is seriously off, Signal push notifications just tell your device to call and fetch. It’s not like they’re unaware and just sending you stuff in plain text.
- gimbalpirate 3y ago
  Can you elaborate on this? I'm still not sure if Signal notifications are any less vulnerable than others.
  - Klonoar 3y ago
    The gist of it is that when Signal sends you a push notification, it's just a marker for "hey, you have updates". It doesn't contain unencrypted data that could be passed to another actor - Signal isn't stupid enough to do this. The app will then call out to pull down any updates. Thus, we wind up in the following situation: the US govt could ask Apple for a list of people who got notifications at X/y/z time to try and tie it to someone who sent at those times, but Signal is so large and widely used that it'd be finding a needle in a haystack (and that's probably putting it lightly). The news from this article is concerning, no doubt... but I'm not particularly worried about Signal is all.
stephen_g 3y ago
My Signal notifications on iOS just say 'Message received!', not sure what else is in the payload but nothing else is displayed... It seems unfathomable that they would push any unencrypted message content or information relating to who is messaging you through notifications that travel over third party servers, so I very much doubt there's much of interest in the payload...
sgentle 3y ago
Fortunately, they did foresee this! The push notification only contains enough information to tell the phone that it should fetch the actual notification content from Signal's servers. Here's a Signal dev talking about it on the Signal-Android GitHub: https://github.com/signalapp/Signal-Android/issues/12961#issuecomment-1557968088 https://github.com/signalapp/Signal-Android/issues/12961#iss... And similarly for Signal-iOS: https://github.com/signalapp/Signal-iOS/issues/962#issuecomment-158685190 https://github.com/signalapp/Signal-iOS/issues/962#issuecomm...

Klonoar 3y ago

Unless my memory is seriously off, Signal push notifications just tell your device to call and fetch. It’s not like they’re unaware and just sending you stuff in plain text.

gimbalpirate 3y ago
Can you elaborate on this? I'm still not sure if Signal notifications are any less vulnerable than others.
- Klonoar 3y ago
  The gist of it is that when Signal sends you a push notification, it's just a marker for "hey, you have updates". It doesn't contain unencrypted data that could be passed to another actor - Signal isn't stupid enough to do this. The app will then call out to pull down any updates. Thus, we wind up in the following situation: the US govt could ask Apple for a list of people who got notifications at X/y/z time to try and tie it to someone who sent at those times, but Signal is so large and widely used that it'd be finding a needle in a haystack (and that's probably putting it lightly). The news from this article is concerning, no doubt... but I'm not particularly worried about Signal is all.

stephen_g 3y ago

My Signal notifications on iOS just say 'Message received!', not sure what else is in the payload but nothing else is displayed... It seems unfathomable that they would push any unencrypted message content or information relating to who is messaging you through notifications that travel over third party servers, so I very much doubt there's much of interest in the payload...

sgentle 3y ago

Fortunately, they did foresee this! The push notification only contains enough information to tell the phone that it should fetch the actual notification content from Signal's servers. Here's a Signal dev talking about it on the Signal-Android GitHub: https://github.com/signalapp/Signal-Android/issues/12961#issuecomment-1557968088 https://github.com/signalapp/Signal-Android/issues/12961#iss... And similarly for Signal-iOS: https://github.com/signalapp/Signal-iOS/issues/962#issuecomment-158685190 https://github.com/signalapp/Signal-iOS/issues/962#issuecomm...