14 ms·
FBI used iPhone notification data to retrieve deleted Signal messages
- frizlab 7mo agoAren’t notifications supposed to be encrypted for Signal?
- dewey 7mo ago[dead]
- shantara 7mo agoiOS stores the previously displayed notifications in an internal database, which was used to access the data. It’s outside of Signal’s control, they recommend disabling showing notification content in their settings to prevent this attack vector
- exitb 7mo agoThey do control the content on the notification. It's a bit odd to put the sensitive text in the notification only to recommend disabling it at the system level.
- frizlab 7mo agoThey do not. They send encrypted notifications. It’s the OS that stores them unencrypted. It’s the OS at fault here IMHO.
- throawayonthe 7mo agoi think they're replying to the "recommendation" part -- if it was recommended, why isn't it the safe default? i haven't actually seen signal or anyone adjacent recommend that previously though, idk where that claim came from
- shantara 7mo agoSorry, the “recommended” was a bad wording on my part. The recommendation comes from the 404 Media article who did the expose on this incident, not Signal itself. I’ve checked the Signal documentation page, and there’s no mention of the privacy implications of the setting: https://support.signal.org/hc/en-us/articles/360043273491-In-App-Notification-Options#ios_notification_options https://support.signal.org/hc/en-us/articles/360043273491-In...
- llacane 7mo agoSignal does NOT send encrypted notification, they send a blank notification that act like a ping, the actual encrypted data is then fetched by the app itself.
- kccqzy 7mo agoNo. They recommended disabling it at the app level. Only the Signal app can control whether the message contents are included in the notifications.
- makosdv 7mo agoYou can choose what to show in the notification and there is an option to include the message, so I'm guessing that allowed some unencrypted incoming messages to be read.
- frizlab 7mo agoSibling comment explains. The notification does arrive encrypted and is decrypted by an app extension (by Signal), however, if the message preview is shown, it is stored unencrypted by iOS. It is that storage that is accessed.
- butvacuum 7mo agoit seems iOS will drop previews into an unencrypted section. which, Is how I expected iOS notification previews to work without unlocking the phone
- krisknez 7mo agoThis kind of vulnerability is not tied to Signal but all apps which send notification.
- throawayonthe 7mo agoThey are; “Messages were recovered from Sharp’s phone through Apple’s internal notification storage—Signal had been removed, but incoming notifications were preserved in internal memory. Only incoming messages were captured (no outgoing).” ie the messages recovered were 1. incoming 2. stored by the OS after decryption i also was spooked by the headline :p
- etiam 7mo agoAlso discussed yesterday, in https://news.ycombinator.com/item?id=47703573 https://news.ycombinator.com/item?id=47703573
- chasil 7mo agoFirst, a critical setting for Signal users: "Signal’s settings include an option that prevents the actual message content from being previewed in notifications. However, it appears the defendant did not have that setting enabled, which, in turn, seemingly allowed the system to store the content in the database." Second, how can I see this notification history?
- alin23 7mo agoNot sure if it's exactly the same, but I had to add a When notification arrives with <message>, do <action> event trigger in my Crank macOS app (https://lowtechguys.com/crank https://lowtechguys.com/crank) so I can show you how to do it on macOS: HOURS=6 EPOCH_DIFF=978307200 SINCE=$(echo "$(date +%s) - $EPOCH_DIFF - $HOURS * 3600" | bc) sqlite3 ~/Library/Group\ Containers/group.com.apple.usernoted/db2/db \ "SELECT r.delivered_date, COALESCE(a.identifier, 'unknown'), hex(r.data) FROM record r LEFT JOIN app a ON r.app_id = a.app_id WHERE r.delivered_date > $SINCE ORDER BY r.delivered_date ASC;" \ | while IFS='|' read -r cfdate bundle hexdata; do date -r $(echo "$cfdate + $EPOCH_DIFF" | bc | cut -d. -f1) '+%Y-%m-%d %H:%M:%S' echo " app: $bundle" echo "$hexdata" | xxd -r -p > /tmp/notif.plist plutil -p /tmp/notif.plist 2>/dev/null \ | grep -E '"(titl|title|subt|subtitle|body|message)"' \ | sed 's/^ */ /' echo "---" done Basically, notifications are in an sqlite db at ~/Library/Group Containers/group.com.apple.usernoted/db2/db and are stored as plist blobs. In recent years, filesystem paths for system services have started to converge for both macOS and iOS so I'm thinking with jailbreak you could get read access to that database and get the same data out of it.
- jhalstead 7mo agoOn a Pixel, I can see some history by going to Android > Settings > Notifications > Manage > Notification History
- seb1204 7mo agoYes, mine (the history option) is turned off. Nice opt in implementation.
- lenerdenator 7mo agoThere needs to be a bit more "group chat" control in Signal messages, wherein you could enforce certain settings for certain chats regardless of the phone settings. You could have group chats that would enforce not showing more information in the notifications, while others would still allow it.
- preinheimer 7mo agoThis feels like it would run against the “I bought my device, I should control how it behaves” line of thinking.
- kome 7mo agosmartphones in general runs against the “I bought my device, I should control how it behaves” line of thinking
- etiam 7mo agoBut it would be pretty well in line with the "I trust my contact with this communication, but only if they're not systematically misled to copy it to readily exploitable insecure storage" line of thinking. Since the purposes of the program are pretty heavy on private communication, I'm inclined to think that takes precedence here, especially considering the consequences for dropping default message previews versus adding default reveal of supposedly private information.
- helpfulclippy 7mo agoI think it fits in pretty well with Signal. As it stands, a group chat can control when a message is automatically deleted for everyone, so everyone can rely on that being a shared setting. That's an intentional design decision. There's no individual opt-out. An individual can disable name or content in notifications in iOS, or set "mute messages" for a chat to prevent notifications from appearing for that specific chat, but there's nothing that gives group members any assurance that other group members are doing that.
- lenerdenator 7mo agoTrue, though the device could simply not be connected to that chat if the user doesn't want to implement the policies necessary to access that chat. The major hole here is that you turn off your notifications and don't have a bunch of database records, but the threat actor somehow finds out who your contacts are, gets a hold of their phone, and can then see all of the messages you sent via their notifications database. So if you want to trust the device for secure communications, you can't do that.
- i_am_proteus 7mo agoReminder that no end-to-end encryption arrangement can do anything before encryption, or after decryption, at the endpoints.
- windowliker 7mo agoRight. It's purely a protection against MitM snooping. The app has to have the messages in plaintext to display to you via whatever mechanism the OS uses. Seems obvious, but also not, at the same time. I've found other ways Signal can leak information, even with disappearing messages. It's not the total install-and-be-done privacy screen that some people think it is, and requires a little effort at the user end to fill in a few gaps.
- jonpalmisc 7mo agoSettings > Notifications > Notification Content > Show: "Name Only" or "No Name or Content" I've had this enabled to prevent sensitive messages from appearing in full whilst showing someone something on my phone, but I guess this is an added benefit as well.
- jhalstead 7mo agoFwiw, in my Signal app on Android this setting is in Settings > Notifications > Messages > Show
- wolvoleo 7mo agoMy Samsung also keeps a history of notification content. Under Settings->Notifications ->Advanced -> Notification History
- tialaramex 7mo agoHowever, if this is important to you then you want Signal to stop telling Android to make the notifications. If it doesn't exist nobody will accidentally make it available. Deleting that history is good to know about after the fact, but preferably lets just not create the problem.
- wolvoleo 7mo agoI need the notifications though. But you can set them without content. That actually works with signal because all it sends through Google Firebase is a notification to wake up the app. If you have the content turned on the app basically fills the content in the notification locally. But you can turn that off.
- embedding-shape 7mo agoI guess enabling Lockdown mode might avoid this particular issue too, together with a bunch of other stuff?
- kome 7mo agosignal is security theater, and a very bad user experience
- noman-land 7mo agoProve it.
- rainingmonkey 7mo ago> very bad user experience "To use the Signal desktop app, Signal must first be installed on your phone."
- deleted 7mo ago[deleted]
- well_ackshually 7mo agothank god whatsapp doesn't do that either. or telegram. or allo back in the day, or every single mobile first messaging app The only one I can think of that doesn't require a mobile login is iMessage, because it's not a chat app, it's lock in and data theft disguised as software
- chinathrow 7mo agoOn Android, when I use WhatsApp and have notifications for groups turned off, I can still see that they arrive briefly and then get removed (the icon top left vanishes). I wonder often, if this is a way to push all group message content into an unencrypted data trace as well - for the same use case.
- arkon_hn 7mo agoIf the notification has the data, then yes. It's trivial to create an app that listens to notifications; Samsung even has one themselves called NotiStar that replicates the notification history feature that Android normally has.
- pipe01 7mo agoI've never seen this happen, maybe you're seeing the "Fetching messages" notification that sometimes pops up for a second?
- chinathrow 7mo agoNo, it's exactly when new messages for muted groups arrive. Confirmed via WhatsApp Web.
- mnls 7mo agoPeople who NEED to hide their notifications from iOS have this already disabled. They rest who "evaluate their threat models" can practice Spy-life-gymnastics by disabling it from Signal.
- shalmanese 7mo agoI thought Signal didn’t show message previews by default and you had to go in and enable it? I’ve never had message previews in my Signal and I don’t remember changing anything. Maybe when they introduced the feature, you could pick but they strongly suggested it not showing?
- foooorsyth 7mo agoThe opposite, actually. Signal endlessly nags you to turn on notifications, and when you turn them on, previews and content are shown by default. You cannot opt out of the nags.
- commandersaki 7mo agoAccording to my setting screen the Show Previews setting is "When Unlocked (Default)". Screenshot of notification settings page: https://files.catbox.moe/3gwjoy.png https://files.catbox.moe/3gwjoy.png
- niek_pas 7mo agoI wonder why Apple doesn't 'just' delete the notification data associated with the app from the internal database when the user deletes the app? It seems like asking for problems to just keep old notification content around forever.
- alsetmusic 7mo agoIt's one of those problems where as soon as someone notices, it's crazy that no one noticed. I can't imagine this not being overhauled going forward. It's just a bad way to operate and now it's news.
- bigyabai 7mo ago> I can't imagine this not being overhauled going forward. On which end, Apple or Signal? Because neither Apple nor Google will overhaul this behavior, the FBI asked for it directly: https://arstechnica.com/tech-policy/2023/12/apple-admits-to-secretly-giving-governments-push-notification-data/ https://arstechnica.com/tech-policy/2023/12/apple-admits-to-...
- ikmckenz 7mo agoThis is different than push data, which already does not contain any content or metadata in Signal. This is about local OS caches, whereas for push notifications Signal only sends a push saying “message received” which wakes the device up and triggers the device to pull the message from the server over the regular e2e encrypted path.
- alsetmusic 7mo agoComment: > Because neither Apple nor Google will overhaul this behavior, the FBI asked for it directly Article: > Apple has since confirmed in a statement provided to Ars that the US federal government “prohibited” the company “from sharing any information,” but now that Wyden has outed the feds, Apple has updated its transparency reporting and will “detail these kinds of requests” in a separate section on push notifications in its next report. Ars verified that Apple’s law enforcement guidelines now notes that push notification records “may be obtained with a subpoena or greater legal process.” I don't read it that way. But I suppose we'll never know. Or if we find out, it'll be in around fifty years.
- alsetmusic 7mo agoOriginal article: FBI Extracts Suspect’s Deleted Signal Messages Saved in iPhone Notification Database[0] 0. https://www.404media.co/fbi-extracts-suspects-deleted-signal-messages-saved-in-iphone-notification-database-2/ https://www.404media.co/fbi-extracts-suspects-deleted-signal...
- tbrownaw 7mo agoThat's unfortunately less informative if you aren't already one of their subscribers.
- deleted 7mo ago[deleted]
- gabeio 7mo agohttps://archive.is/bSQhD https://archive.is/bSQhD You can view their link here.
- alsetmusic 7mo ago> That's unfortunately less informative if you aren't already one of their subscribers. Subscribe! They're probably the best journalism org in western media right now. Of course, that's not always an option for everyone, but I hope HN readers with a few extra bucks will check them out.
- dfir-lab 7mo ago[dead]
- blitzar 7mo ago> testimony in a recent trial Court cases are the real way to audit security. Larping about security and complaining about companies responding to court orders only gets you so far. Its way more useful to look at what actually happens in reality.
- tbrownaw 7mo agoThe recent Trivy / LiteLLM mess was also a security thing, and seems rather different.
- jMyles 7mo agoThe problem is that, in the current environment of dishonest and corrupt states, "what actually happens in reality" isn't the same as what happens in court because of parallel construction.
- tclancy 7mo agoI know it’s not germane to the Signal issue, but this caught my eye, “who previously pleaded guilty to providing material support to terrorists”. The case comes with a long statement about the Antifa “organization”. Just your weekly reminder we are living under an Orwellian administration. https://www.justice.gov/opa/pr/antifa-cell-members-convicted-prairieland-ice-detention-center-shooting https://www.justice.gov/opa/pr/antifa-cell-members-convicted...
- bronco21016 7mo agoYes and no. Court cases certainly will disclose what capabilities various parties have come up with when it comes to security. However, there are documented cases where the government chooses to abandon prosecution for the sole purpose of preventing disclosure of some of their cyber capabilities.
- SwtCyber 7mo agoTrue, court cases are one of the few times details actually surface
- SergeAx 7mo agoProbably stupid question: why won't they e2e-encrypt push notifications too? The vector is obvious and has been open since forever.
- 0x62 7mo agoSignal does not send any sensitive information in push notifications sent via APNs [0]. This story concerns the local OS cache of push notifications, which are triggered after E2E decryption has occurred. [0] https://mastodon.world/@Mer__edith/111563865413484025 https://mastodon.world/@Mer__edith/111563865413484025
- tbrownaw 7mo agoThe "e" in e2e encryption is a computing device, not the device's user's brain.
- SergeAx 7mo agoRight. So I send a push notification with the "silent" flag and encrypted content; the app receives it, decrypts the text, and displays the notification locally. Google/Apple has only ciphertext in their FBI/CIA/NSA-accessible databases.
- jhatemyjob 7mo agoI'm confused. You mean the iOS system notification would display the decrypted message in plaintext? Or do you mean the iOS system notification would display the encrypted message (i.e. it would be unreadable)?
- SergeAx 7mo agoThe app decrypts the message and displays it via the system notification.
- jhatemyjob 7mo ago
- echelon_musk 7mo agoAs an aside, I decrypted an encrypted iPhone backup using a tool from GitHub because I wanted easy access to my Voice Memo recordings. Photos I had long deleted were still in the backup! It's quite surprising just how much is being stored by the phone.
- boysenberry 7mo agoWhat did you use?
- echelon_musk 7mo agohttps://github.com/PeterUpfold/dump-iphone-backup https://github.com/PeterUpfold/dump-iphone-backup
- nixosbestos 7mo agoUm. Android has notification history also and I see no similar ability to hide notification content from the system ...
- TeMPOraL 7mo agoGood. The moment they add it, all kinds of apps will start to abuse it, for "sekhurity" (read: engagement) reasons. See e.g. all the apps that now disallow taking screenshots, for no legitimate reason. Personally I'd be in favor of a hard app store policy, that if an app notifies you about something, all the importantdetails (like full message text) must be included - specifically to allow the user to view the important information without having to open the app itself.
- nixosbestos 7mo agoI'm referring to what sounds like a feature of the app, not the OS... The app... already chooses what to send through the OS notification API so I really don't have any idea what scenario you're worried about. I generally sympathize, I also don't like when apps block screenshots (or even more stupidly, they can block Android's amazing "select text from anywhere" feature...). But I don't think there are similar concerns for Signal allowing me to hide notification content from the OS.
- TeMPOraL 7mo agoRight. I'm saying most apps shouldn't be allowed to send a notification at all if they're not going to put the proper content in it. As it is, many apps already choose to omit notification body, instead supplying nothing or some noninformative text, forcing you to tap through to the app to see what the notification was about. If Signal is doing anything unusual here, is that it has a switch to enable showing actual content.
- nixosbestos 7mo agoI get it. I am stubborn. That behavior results in a polite but direct email/review followed by an uninstall. I'm so tired of being treated like disposable crap by everyone trying to make a buck the cheapest and shittiedt way possible.
- 6thbit 7mo agoSo this is where we find out the one end of e2e is the phone and not the app. Semi-related, in whatsapp reading the text in the notification doesn't mark the message as read, so the OS is kinda mitm here.
- zenoprax 7mo agoSignal creates the notification, does it not? That's like claiming `echo "my_private_data" | notify-send` is insecure. If piping encrypted content resulted in a plaintext notification then you'd have a right to be concerned.
- coldtea 7mo agoWhat prevents the phone from taking screenshots of you reading the messages in the app? The actual one end is the phone, not the app, period.
- 6thbit 7mo agoExactly yes, and that is insecure here because the app relayed the message beyond its layer and ownership. Thus not making the app the end of the communication.
- ChrisArchitect 7mo ago[dupe] Discussion on source: https://news.ycombinator.com/item?id=47703573 https://news.ycombinator.com/item?id=47703573
- 1vuio0pswjnm7 7mo ago"However, it appears the defendant did not have that setting enabled, which, in turn, seemingly allowed the system to store the content in the database." "[A]llowing the system to store the content in the database" where a third party, such as Apple or a government, can access it is the default Only a small minority of users know about settings and how to change them. The vast majority of users do not change default settings. Apple knows this
- esseph 7mo ago> Only a small minority of users know about settings and how to change them. I couldn't believe this so went to look up some data on this. Holy FUCK that is bleak. There needs to be way more computer education, not just "how2type" classes.
- sillysaurusx 7mo agoUnfortunately, users don’t want to learn. They want the app to do what they want. Anything involving learning is likely to get an instant “screw this” reaction. Seen it firsthand many times, and always found it mystifying.
- shooly 7mo ago[flagged]
- sillysaurusx 7mo agoMind reading the rules and leaving more substantive comments? Ideally ones with less “you”s. Obviously the cause is different interests. Different interests can explain everything from a bad decision to going to sleep early. It says nothing useful.
- esseph 7mo agoIf you don't know something is even possible, how do you know the application is working in the way you intend?
- walmas 7mo agoPeople also got charges in the same case for removing people from a Signal chat
- _slih 7mo ago[flagged]
- nottorp 7mo ago... and I thought I'm turning off notifications for all apps just so I don't get spammed. Looks like the setting is more useful than that.
- pigggg 7mo agoJust curious, how come at least once a month signal bugs me to turn on notifications? I said no for a reason, every single time - why does it keep asking? Not implying anything evil but it feels a bit weird esp after this.
- greysonp 7mo agoSignal developer here. It's just because notification reliability is always a top support complaint, and a lot of people turn off notifications and don't realize they've done so. Admittedly, once a month is likely too aggressive.
- jacquesm 7mo agoAny time after a user switches it off on purpose is too aggressive.
- pigggg 7mo agoIs there some "no means no" additional setting that could be added where someone has to go into settings that would prevent that? I fear that with the notifications pop up asking me this I might hit the wrong button and woops turn it on.
- NAR8789 7mo agoTry from inside the signal app itself instead of system settings? On android Signal has an option at hamburger menu > Settings > Notifications > Notifications (toggle switch) Oh... hmm, two toggles actually. One at Settings > Notifications > Calls > Notifications toggle, and the other at Settings > Notifications > Messages > Notifications toggle
- dataflow 7mo agoHow about instead of prompting to enable notifications, you leave a small banner or other unintrusive/non-annoying UI noting that they're off, which users can tap in order to learn more about how to reenable them? For an app that prides itself on privacy, it's kind of crazy that you're making it so easy to accidentally blow it.
- bharat1010 7mo agoKind of a wake-up call that even "deleted" messages aren't really gone if the OS is caching notification previews — makes you rethink what end-to-end encryption actually protects you from.
- jsdevtom 7mo agoIf I have access to the UI, I don't need to break your encryption.
- iririririr 7mo ago[dead]
- halapro 7mo agoWhile it's definitely surprising that the OS caches this data after the notifications have been swiped away, I always thought that notifications are an obvious hole in the whole E2E encryption setup.
- Thorrez 7mo agoAIUI, Signal push notifications just saying a message was received. Signal then fetches the E2E encrypted message from the server and decrypts it locally. So Apple/Google cannot read the messages, nor can Signal servers.
- leesalminen 7mo agoAIUI, Signal decrypts the E2EE message locally, but then sends the decrypted message to iOS in order to display the notification to the user. iOS then stores this data and it persists after the user dismisses the notification. This makes sense and there's really no way around it without a change from Apple. If iOS is going to show the user a Signal notification with the decrypted message in the notification body, then iOS must be given the decrypted message. iOS could (and probably should) delete that data off the device as soon as the user dismisses/engages with the notification. But it sounds like they do not.
- Thorrez 7mo agoI agree. My point is that this isn't an "obvious hole in the whole E2E encryption setup", because no network actor (e.g. Google, Apple, Signal servers) can read the data. This "hole" in E2E is the same as any malware on the device. If the device cannot be trusted, no form of E2E will work. The E2E encryption is functioning properly. The problem here is completely unrelated to E2E encryption. E.g. you could have a personal notes app that makes no network traffic, but generates notifications occasionally regarding your notes, and it could have this same problem, even though no messages are sent over the network, and in fact the phone could have all networking capabilities disabled and still have this problem. >This makes sense and there's really no way around it without a change from Apple. There is a bit of a workaround: Signal has a setting to not put message content in the notification. That fixes this AIUI.
- seydor 7mo agoWe are running out of Murphy's laws for digital communications. People will go back to physical messaging
- coldtea 7mo agoYounger people have largely abandonded even physical contact and talk, they ain't going back nowhere.
- dav 7mo agoiOS Data Protection — The Four Classes Data Protection is implemented by constructing and managing a hierarchy of keys, building on the hardware encryption technologies built into Apple devices. It's controlled on a per-file basis by assigning each file to a class; accessibility is determined by whether the class keys have been unlocked. The four protection classes, from strongest to weakest: NSFileProtectionComplete — Files are only accessible when the device is unlocked. NSFileProtectionCompleteUnlessOpen — A file can only be opened when the device is unlocked, but is not closed when the device is locked — it's encrypted when the last open handle is closed. Suitable for data being uploaded in the background. NSFileProtectionCompleteUntilFirstUserAuthentication — The resource cannot be accessed until after the device has booted. After the user unlocks the device for the first time, the app can access the resource and continue to do so even if the user subsequently locks the device. Fortify This is commonly called AFU (After First Unlock). This is the default class for all third-party app data not otherwise assigned to a Data Protection class. NSFileProtectionNone — The resource has no special protections. It can be read or written at any time. The encryption only uses a key derived from the device's UID. The BFU/AFU Distinction — The Heart of the Signal Issue Apple's iOS devices operate in two key security states that directly impact data accessibility: Before First Unlock (BFU) and After First Unlock (AFU). When an iPhone is in the BFU state, it has been powered on or rebooted but not yet unlocked with a passcode. In this state, the Secure Enclave does not release the decryption keys needed to access most user data. Once you've unlocked once (AFU), files protected with NSFileProtectionCompleteUntilFirstUserAuthentication become accessible, the Keychain is available, and background processes and apps can access encrypted content as needed. The Signal notification content issue connects here because notification data (including previews) stored in the default CompleteUntilFirstUserAuthentication class remains decryptable by any process — including OS-level forensic tools — as long as the phone has been unlocked at least once since the last reboot.
- seethishat 7mo agoA lot of dumb criminals seem to carry smart phones. The irony.
- scarecrowbob 7mo agoProbably, but these are people who are being charged for political "crimes" brought mostly because the government doesn't think people have a right to protest. While it's unsurprising that the citizen who discharged their weapon was tried for this, most of the other folks were just doing run-of-the-mill protest stuff. I also get that in Texas they are fine "criminalizing" protesting, but that's just part of its hyper-authoritarian "charm", and a lot of us don't think that protesting in itself should be criminal.
- inemesitaffia 7mo agoThey are part of a larger direct action group.
- snatekay 7mo agoThe person whose Signal notifications were extracted, Lynette Sharp, was not the one who shot a cop in the neck, no. The reason she pleaded guilty to “providing material support to terrorists” is that she helped the shooter get away afterward and gave him a disguise; he remained on the lam for ten days.
- lofaszvanitt 7mo agoSigh, just the usual. If you don't know the platform's nuances, you are fckd.
- donohoe 7mo agoWas this not a known issue (in terms of trade-offs) for years? I recall discussion back in 2018 at least that made mention of this concern. https://github.com/RealityNet/iOS-Forensics-References https://github.com/RealityNet/iOS-Forensics-References https://theforensicscooter.com/2021/10/03/ios-knowledgec-db-notifications/ https://theforensicscooter.com/2021/10/03/ios-knowledgec-db-...
- b8 7mo agoSounds like an intentional government feature. Just speculation though. I'm glad I have a Pixel, but I'm on the default OS and need to switch to GrapiousOS (secure version). Just haven't due to lack of nice Google features.
- upofadown 7mo agoPutting on my user hat... "OK. Signal has forward secrecy. So messages are gone after I receive them. Great!" Oh, you didn't turn on disappearing messages? Oh, right, then forensic tools like Cellebrite can get them. You have to turn on disappearing messages. The default is off. Oh, you did turn on disappearing messages? We send the messages in notifications. So the OS can keep them. Turns out Apple was doing that. There is an option you can turn on to prevent that. It is off by default. "I'll just delete the entire app!" No, sorry, the OS still has your messages... At what point does the usability get so bad that we can blame the messaging system? This same app had a usability issue that turned into a security issue just last year: End to End Encrypted Messaging in the News: An Editorial Usability Case Study (my article) https://articles.59.ca/doku.php?id=em:sg https://articles.59.ca/doku.php?id=em:sg
- DevX101 7mo agoThe median user isn't going to change default settings, so your app is as secure as whatever the default it.
- stvltvs 7mo agoEven if I change the setting, my messages aren't truly secure against this unless all recipients do the same on all of their devices.
- jacquesm 7mo agoPeople keep pushing signal because it is supposedly secure. But it runs on platforms that are so complex with so much eco system garbage that there is no way know even within a low percentage of confidence if you've done everything required to ensure you are communicating just with the person you think you are. There could be listeners at just about every layer and that is still without looking at the meta-data angle which is just as important (who communicated with who and when, and possibly from where).
- OutOfHere 7mo agoThere is nothing secure about sending encrypted content to notifications. If it were secure, it would only notify that there is a message, with no details included.
- SilasX 7mo agoHmmm this is interesting. Because I've long had the complaint that notifications are frustratingly ephemeral. There have been many cases where I've gotten a notification that my phone clearly has but which I can't read, because when I tap it, it's purged permanently, and then I have a spotty internet connection, so I can't see it in the actual app that loaded. I'm always like "JFC, can't you cache the notifications, so I can see it there while waiting for the app to gets its act together?" But no, that's never an option. So I'm getting a laugh out of how notifications last long enough to be extracted by someone just not the person that they're for. (Though to be fair, it could be a case of a notification that was never tapped, and therefore hadn't been purged yet. I couldn't tell from the story.)
- sneak 7mo agoHow convenient that Apple can turn a blind eye to this, and maintain their useful fiction that they don’t provide law enforcement backdoors. Privacy, that’s Apple: https://www.reuters.com/article/world/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sour-idUSKBN1ZK1CO/ https://www.reuters.com/article/world/exclusive-apple-droppe...
- SilverElfin 7mo agoIs there a way to delete all Apple notification history from Apple’s servers?
- lowbloodsugar 7mo agoTerrorism charges. That’s what we should be talking about.
- komali2 7mo agoIt sounds like they were considering liberating the ICE concentration camp. If you go down that route, you need to be ready for the terrorism charges. They brought rifles and one of them allegedly shot at a cop. Personally, it's a moral good to free people from a concentration camp, even if it requires violence to do so. However it's also obvious that when you oppose a State, you get hit with terrorism charges. ...unless you're a jan6er, of course.
- SwtCyber 7mo agoThis is one of those cases where the "secure app" narrative collides with how messy real systems actually are
- AlBugdy 7mo agoSo Signal is sending the notifications through Apple's ecosystem somehow, presumably to save battery life by not having a persistent connection to Signal's servers? That's what I think happens on Android, too. When I had Lineage years ago, I had a persistent connection to Signal as the notifications didn't come through Google. Unfortunately there was a persistent notification for the persistent connection with no way to remove it. After these news Signal should ask the users ASAP and on new installs something like: > Do you want the notifications to pass through Apple (no privacy, better battery) or through Signal itself (better privacy, but less battery life due to the persistent connection to Signal's servers. It should be as part of the setup wizard, not inside the settings. Correct me if I've misunderstood something.
- svpk 7mo agoIn my recollection, which may be imperfect: 1. On android if Google Play isn't available (or you install the no Google apk version) it'll use a websocket for notifications. Apple doesn't allow a persistent connection except through their own notification framework. 2. In either case Signal doesn't send message contents through the notification framework (not even encrypted). Once Signal receives a notification the app wakes up and reaches out to the signal service directly for actual encrypted message. 3. Regardless when signal shows the contents of your message in the notification menu of your device your device keeps a record on your device of that message content. The FBI here didn't get anything from apple, once they had the apple device unlocked they looked at the notification database on the device to get the message contents. This isn't really any different from the fact that if the FBI has your unlocked phone they can read your signal messages. The notable bit is that the notification database retains messages even after the app is deleted.
- 0xR1CK 7mo ago" if the ___ has your unlocked phone they can read your signal messages. " It's worth noting you can add an additional security check pin/bio/pass to signal that is different from your phone unlock. The protester had also uninstalled signal from phone (even with access to the phone, they would not have access to signal, if they had reinstalled signal, and some how got the security pin or passphrase, they wouldn't be able to load the prior messages, without either, no messages at all).
- kouru225 7mo agoI don’t know why anyone trusts Signal. People keep talking about them. I thought it was clear years ago that they were a sketchy company
- ttkari 7mo agoThis is the same issue that got a local drug organization busted some time ago - their entire α-PVP cooking operation was busted after one of the gang members was caught during a sale, his iphone was confiscated and the entire org was right there in the notification history. I guess that's what you deserve if you trust apple with your operational security.
- fmx 7mo agoPerhaps a stupid question, but why do notifications need to be stored in a database in persistent storage at all? OK, maybe they can be stored until they're dismissed in case the battery suddenly dies, so they can be displayed again on next boot and are not lost, but it sounds like they are being stored long after they are dismissed.
- deleted 7mo ago[deleted]
- heisenbit 7mo agoI suspect they live in a database and are eventually going where GC data goes.
- northstar-au 7mo ago[dead]
- Ms-J 7mo ago[flagged]
- lrvick 7mo agoThere is no such thing as strong end to end encryption on a proprietary operating system no one but the provider can verify.
- DavideNL 6mo agoIt would be great if each Signal group/contact had the setting: "Name Only" or "No Name or Content"; That way, you could disable this only for "non-sensitive" groups / contacts...