3 ms·

This is the third time in a week that I read about this and, to me, the most important question has remained unanswered: If a push notification's payload is E2E

This is the third time in a week that I read about this and, to me, the most important question has remained unanswered: If a push notification's payload is E2E-encrypted (consider, e.g., push notifications for Signal running on GrapheneOS with sandboxed Google Play Services), is there still a data leak? Like, what metadata are people referring to? The fact that I use Signal at all? Of course, depending on the app, it coupd be possible to correlate even E2E-encryped push notifications with other data on that app's backend server etc. But beyond specific apps is there a generic vulnerability here?

0xy 3y ago
The approximate size of the payload, the application, the time, maybe where you received it (if you were on a cellular network). All of this has a lot of value. You don't exactly need the message or the recipient.
- codethief 3y ago
  What value does it have? The payload of Signal's push notifications should have roughly the same length every time as they are only used to wake up the app. The time I receive a push notification doesn't depend on me, but on when my contacts send messages. (Yes, you could use this to narrow down someone's time zone but not much more than that. Plus there are a million other ways to determine the time zone.)
  - ratg13 3y ago
    Let’s say you are a married politician and I know you use gay hookup apps regularly. I now have enough information to either blackmail you further or end your career.
    - codethief 3y ago
      I don't still understand what risk push notifications represent here. Google & Apple maintain a list of all your apps, anyway. Any government can easily subpoena that list without having to put in much effort or analyze push notifications.
halJordan 3y ago
The data leak, more of an oracle than anything else, is that you have an active account with the business sending the push. And it's not really even a data leak because it's data generated in the course of activity the user has requested.
- codethief 3y ago
  > is that you have an active account with the business sending the push But they wouldn't need to analyze push notifications for that, they could simply ask Google/Apple who installed a given app.
walrus01 3y ago
> Like, what metadata are people referring to? Time of day that you're awake/active, the frequency of message push notifications vs your travel patterns when you might be expected to be offline, weekday vs weekend message traffic volumes per day, traffic volumes on holidays, all these sorts of things are valuable metadata for an NSA-like organization.
- codethief 3y ago
  > Time of day that you're awake/active, […] your travel patterns when you might be expected to be offline But the push notifications I receive through Signal don't tell you any of those things?

0xy 3y ago

The approximate size of the payload, the application, the time, maybe where you received it (if you were on a cellular network). All of this has a lot of value. You don't exactly need the message or the recipient.

codethief 3y ago
What value does it have? The payload of Signal's push notifications should have roughly the same length every time as they are only used to wake up the app. The time I receive a push notification doesn't depend on me, but on when my contacts send messages. (Yes, you could use this to narrow down someone's time zone but not much more than that. Plus there are a million other ways to determine the time zone.)
- ratg13 3y ago
  Let’s say you are a married politician and I know you use gay hookup apps regularly. I now have enough information to either blackmail you further or end your career.
  - codethief 3y ago
    I don't still understand what risk push notifications represent here. Google & Apple maintain a list of all your apps, anyway. Any government can easily subpoena that list without having to put in much effort or analyze push notifications.

halJordan 3y ago

The data leak, more of an oracle than anything else, is that you have an active account with the business sending the push. And it's not really even a data leak because it's data generated in the course of activity the user has requested.

codethief 3y ago
> is that you have an active account with the business sending the push But they wouldn't need to analyze push notifications for that, they could simply ask Google/Apple who installed a given app.

walrus01 3y ago

> Like, what metadata are people referring to? Time of day that you're awake/active, the frequency of message push notifications vs your travel patterns when you might be expected to be offline, weekday vs weekend message traffic volumes per day, traffic volumes on holidays, all these sorts of things are valuable metadata for an NSA-like organization.

codethief 3y ago
> Time of day that you're awake/active, […] your travel patterns when you might be expected to be offline But the push notifications I receive through Signal don't tell you any of those things?