3 ms·
> Oh, you did turn on disappearing messages? We send the messages in notifications. So the OS can keep them. Worse than that, they did not take advantage of th
by GeekyBear 6mo ago
> Oh, you did turn on disappearing messages? We send the messages in notifications. So the OS can keep them.
Worse than that, they did not take advantage of the ability to send that message data as an encrypted payload inside the notification.
https://blog.davidlibeau.fr/push-notifications-are-a-privacy-nightmare/ https://blog.davidlibeau.fr/push-notifications-are-a-privacy...
Either do not include sensitive user data inside a notification by default, or encrypt that data before you send it to the notification server.
- janfoeh 6mo agoAccording to Michael Tsai, they did use encrypted notification payloads. The OS just then stores the decrypted payloads in its notification database. [0] [0] https://mjtsai.com/blog/2026/04/10/notifications-privacy/ https://mjtsai.com/blog/2026/04/10/notifications-privacy/
- greysonp 6mo agoSignal developer here. Our FCM and APN notifications are empty and just tell the app to wake up, fetch encrypted messages, decrypt them, and then generate the notification ourselves locally.
- GeekyBear 6mo agoThat's certainly a better state of affairs. So you just need to fix the default setting and not display the message text in notifications to prevent this issue in the future?