I think the actual vulnerability is a way to connect a pseudonymous account on a third-party messaging service with the real-name account associated with a pers

I think the actual vulnerability is a way to connect a pseudonymous account on a third-party messaging service with the real-name account associated with a person's phone OS. FBI orders an "anonymous" messaging service to give them the Google and Apple push tokens that the service created and stored on its backend for some pseudonymous user when that user first registered through a smartphone app. Then the FBI goes to Google and Apple and orders them to hand over the gmail or iCloud ID associated with that push token. Which implies there are only 2 workarounds: * for a user - use a burner phone with a burner Gmail/iCloud ID and all forms of sync and cloud backups disabled * for privacy-focused messaging services - do not generate push tokens without an explicit user request. Tell the users about the privacy risk. And if a user opts into push notifications, frequently delete existing tokens, purge them from all logs and backups, and generate new ones.