4 ms·

First, a critical setting for Signal users: "Signal’s settings include an option that prevents the actual message content from being previewed in notifications

by chasil 6mo ago

First, a critical setting for Signal users: "Signal’s settings include an option that prevents the actual message content from being previewed in notifications. However, it appears the defendant did not have that setting enabled, which, in turn, seemingly allowed the system to store the content in the database." Second, how can I see this notification history?

alin23 6mo ago
Not sure if it's exactly the same, but I had to add a When notification arrives with <message>, do <action> event trigger in my Crank macOS app (https://lowtechguys.com/crank https://lowtechguys.com/crank) so I can show you how to do it on macOS: HOURS=6 EPOCH_DIFF=978307200 SINCE=$(echo "$(date +%s) - $EPOCH_DIFF - $HOURS * 3600" | bc) sqlite3 ~/Library/Group\ Containers/group.com.apple.usernoted/db2/db \ "SELECT r.delivered_date, COALESCE(a.identifier, 'unknown'), hex(r.data) FROM record r LEFT JOIN app a ON r.app_id = a.app_id WHERE r.delivered_date > $SINCE ORDER BY r.delivered_date ASC;" \ | while IFS='|' read -r cfdate bundle hexdata; do date -r $(echo "$cfdate + $EPOCH_DIFF" | bc | cut -d. -f1) '+%Y-%m-%d %H:%M:%S' echo " app: $bundle" echo "$hexdata" | xxd -r -p > /tmp/notif.plist plutil -p /tmp/notif.plist 2>/dev/null \ | grep -E '"(titl|title|subt|subtitle|body|message)"' \ | sed 's/^ */ /' echo "---" done Basically, notifications are in an sqlite db at ~/Library/Group Containers/group.com.apple.usernoted/db2/db and are stored as plist blobs. In recent years, filesystem paths for system services have started to converge for both macOS and iOS so I'm thinking with jailbreak you could get read access to that database and get the same data out of it.
jhalstead 6mo ago
On a Pixel, I can see some history by going to Android > Settings > Notifications > Manage > Notification History
- seb1204 6mo ago
  Yes, mine (the history option) is turned off. Nice opt in implementation.
- arvid-lind 6mo ago
  Wasn't sure if it was the Pixel or GrapheneOS, but what a relief to actually be covered in one of these weird 0day issues. Unrelated to the OP, but I bet the thousands of "exploits" that Claude Mythos has identified already are a lot of these kind of things that regular people would never think about.
627467 6mo ago
On android there are apps that let you see the history - i use NotiStar occasionally to see if i unwittingly dismissed important notifications. And i believe there are apps/settings that help you clear the history from the device. But this is a reminder that these centralized notification infrastructure (FCM and APNs) store notification content (if the app is told to send content in it - signal with option enabled wouldn't send content) even if we clear local history these middleman still hold it
- chasil 6mo ago
  On Lineage Android, i see: Settings / Notifications / Notification History. If you drop a settings widget on your home screen, it will let you choose a specific area, including notifications. I don't know if the output is the complete database.
nashashmi 6mo ago
On android its quite easy. There is a page of a protocol address that has all notifications show. I used to have a shortcut to it. It has been years since I was on android. But it was really useful each time I did not see a notification in time. Edit: typo
- tsimionescu 6mo ago
  > I used to have a seizure to it. Hopefully, you meant to write "shortcut"...
  - nashashmi 6mo ago
    Yes! Thanks.
commandersaki 6mo ago
So I wonder about this. The quote from the 404 media article [0] is: “We learned that specifically on iPhones, if one’s settings in the Signal app allow for message notifications and previews to show up on the lock screen, [then] the iPhone will internally store those notifications/message previews in the internal memory of the device,” a supporter of the defendants who was taking notes during the trial told 404 Media The default setting appears to be to only show notification preview when unlocked. Will that notification still be stored unencrypted in notification storage or is it in an encrypted store because it will preview after unlock? It makes sense that any notification that previews on the lock screen would be unencrypted (including the case where it is encrypted but the encryption key is adjacently stored). This all reads to me that this was a user induced OPSEC issue and Signal had the right defaults. [0] https://archive.is/bSQhD#selection-619.0-622.0 https://archive.is/bSQhD#selection-619.0-622.0
- sillysaurusx 6mo ago
  I think that’s a little nutty. People go to signal for secure messaging. That’s their entire brand. An insecure by default setting is the wrong setting, even if it nets them a lot of tech illiterate users. Compromising the security of the system defeats the entire point of using Signal instead of some other messenger. By this logic, you, me, and everyone else using the defaults are using bad opsec. Doesn’t that strike you as problematic?
  - amazingman 6mo ago
    "Security" is not a binary, but a spectrum along which there are various tradeoffs. The vendor attempts to select the best configuration for its average/median user, and that's almost by definition not going to be the most secure configuration (see: tradeoffs). I do think there should be some UI somewhere that allows for locking all things down to the most secure configuration possible.
  - commandersaki 6mo ago
    I posted this elsewhere and I said this in my post, but the default setting is actually not the insecure one: https://files.catbox.moe/3gwjoy.png https://files.catbox.moe/3gwjoy.png (supposing that previews are stored encrypted when locked which is what the 404media passage implies and nothing to say to the contrary). This user went out of their way to show previews on the lock screen, that is an OPSEC failure, even if you do not consider the acquisition of the messages digitally.
benhurmarcel 6mo ago
I wonder how long does the system store those notifications
SwtCyber 6mo ago
You don't, at least not without forensics tools

by chasil 6mo ago

alin23 6mo ago

Not sure if it's exactly the same, but I had to add a When notification arrives with <message>, do <action> event trigger in my Crank macOS app (https://lowtechguys.com/crank https://lowtechguys.com/crank) so I can show you how to do it on macOS: HOURS=6 EPOCH_DIFF=978307200 SINCE=$(echo "$(date +%s) - $EPOCH_DIFF - $HOURS * 3600" | bc) sqlite3 ~/Library/Group\ Containers/group.com.apple.usernoted/db2/db \ "SELECT r.delivered_date, COALESCE(a.identifier, 'unknown'), hex(r.data) FROM record r LEFT JOIN app a ON r.app_id = a.app_id WHERE r.delivered_date > $SINCE ORDER BY r.delivered_date ASC;" \ | while IFS='|' read -r cfdate bundle hexdata; do date -r $(echo "$cfdate + $EPOCH_DIFF" | bc | cut -d. -f1) '+%Y-%m-%d %H:%M:%S' echo " app: $bundle" echo "$hexdata" | xxd -r -p > /tmp/notif.plist plutil -p /tmp/notif.plist 2>/dev/null \ | grep -E '"(titl|title|subt|subtitle|body|message)"' \ | sed 's/^ */ /' echo "---" done Basically, notifications are in an sqlite db at ~/Library/Group Containers/group.com.apple.usernoted/db2/db and are stored as plist blobs. In recent years, filesystem paths for system services have started to converge for both macOS and iOS so I'm thinking with jailbreak you could get read access to that database and get the same data out of it.

jhalstead 6mo ago

On a Pixel, I can see some history by going to Android > Settings > Notifications > Manage > Notification History

seb1204 6mo ago
Yes, mine (the history option) is turned off. Nice opt in implementation.
arvid-lind 6mo ago
Wasn't sure if it was the Pixel or GrapheneOS, but what a relief to actually be covered in one of these weird 0day issues. Unrelated to the OP, but I bet the thousands of "exploits" that Claude Mythos has identified already are a lot of these kind of things that regular people would never think about.

627467 6mo ago

On android there are apps that let you see the history - i use NotiStar occasionally to see if i unwittingly dismissed important notifications. And i believe there are apps/settings that help you clear the history from the device. But this is a reminder that these centralized notification infrastructure (FCM and APNs) store notification content (if the app is told to send content in it - signal with option enabled wouldn't send content) even if we clear local history these middleman still hold it

chasil 6mo ago
On Lineage Android, i see: Settings / Notifications / Notification History. If you drop a settings widget on your home screen, it will let you choose a specific area, including notifications. I don't know if the output is the complete database.

nashashmi 6mo ago

On android its quite easy. There is a page of a protocol address that has all notifications show. I used to have a shortcut to it. It has been years since I was on android. But it was really useful each time I did not see a notification in time. Edit: typo

tsimionescu 6mo ago
> I used to have a seizure to it. Hopefully, you meant to write "shortcut"...
- nashashmi 6mo ago
  Yes! Thanks.

commandersaki 6mo ago

So I wonder about this. The quote from the 404 media article [0] is: “We learned that specifically on iPhones, if one’s settings in the Signal app allow for message notifications and previews to show up on the lock screen, [then] the iPhone will internally store those notifications/message previews in the internal memory of the device,” a supporter of the defendants who was taking notes during the trial told 404 Media The default setting appears to be to only show notification preview when unlocked. Will that notification still be stored unencrypted in notification storage or is it in an encrypted store because it will preview after unlock? It makes sense that any notification that previews on the lock screen would be unencrypted (including the case where it is encrypted but the encryption key is adjacently stored). This all reads to me that this was a user induced OPSEC issue and Signal had the right defaults. [0] https://archive.is/bSQhD#selection-619.0-622.0 https://archive.is/bSQhD#selection-619.0-622.0

sillysaurusx 6mo ago
I think that’s a little nutty. People go to signal for secure messaging. That’s their entire brand. An insecure by default setting is the wrong setting, even if it nets them a lot of tech illiterate users. Compromising the security of the system defeats the entire point of using Signal instead of some other messenger. By this logic, you, me, and everyone else using the defaults are using bad opsec. Doesn’t that strike you as problematic?
- amazingman 6mo ago
  "Security" is not a binary, but a spectrum along which there are various tradeoffs. The vendor attempts to select the best configuration for its average/median user, and that's almost by definition not going to be the most secure configuration (see: tradeoffs). I do think there should be some UI somewhere that allows for locking all things down to the most secure configuration possible.
- commandersaki 6mo ago
  I posted this elsewhere and I said this in my post, but the default setting is actually not the insecure one: https://files.catbox.moe/3gwjoy.png https://files.catbox.moe/3gwjoy.png (supposing that previews are stored encrypted when locked which is what the 404media passage implies and nothing to say to the contrary). This user went out of their way to show previews on the lock screen, that is an OPSEC failure, even if you do not consider the acquisition of the messages digitally.

benhurmarcel 6mo ago

I wonder how long does the system store those notifications

SwtCyber 6mo ago

You don't, at least not without forensics tools