7 ms·
Apple fixes bug that cops used to extract deleted chat messages from iPhones
- unethical_ban 6mo agoI wonder if the same flaw exists on Android/GrapheneOS.
- nxobject 6mo agoNote that Signal offers the option to use generic “You’ve received messages” notifications - it’s good practice in general.
- sunnybeetroot 6mo agoSo does every app, go to iOS settings > notifications shows previews > never.
- elashri 6mo agoI wish it can be disabled for particular apps and not an all or nothing situation.
- Barbing 6mo agoCan be! Settings > Apps > choose an app > Lock Screen Appearance: Show Previews - Never
- marcus2026 6mo agoThe message text is still sent to the push notification server from the app's infrastructure - this setting simply stops the phone from displaying the message. The app itself must choose not to send the message text in the push notification.
- bradyd 6mo agoThat setting is available for each individual app.
- Barbing 6mo agoIs setting it from Signal directly more trustworthy? Or maybe it’s impossible for iOS to store the preview content if it never showed in the first place, but not sure if it’s even documented.
- rvnx 6mo agoMost likely changes the preview on the client-side, but the message is still full on the server-side
- deleted 6mo ago[deleted]
- solenoid0937 6mo agoCorrect, parent comment is spreading misinformation/false sense of security.
- ThePowerOfFuet 6mo agoSignal does not have the plaintext of the messages and therefore could not send it as part of the notification.
- chislobog 6mo agoApparently if I’m reading the work of others correctly a notification component and subsequent other interaction logs, in this case that the notification was not generated, is also logged in knowledgeC pointing to at least some metadata of non-notified messages logged.
- privacyking 6mo agoThe signal app does and does the OS once the notification is displayed. The latter is where this issue originates
- thire 6mo agoThat's the first thing that came to mind. Glad that they already thought about it!
- doublerabbit 6mo agoAnd if you turn off notifications, Signal is more than happy to nag at you for having notifications turned off.
- modeless 6mo agoOh, I was originally confused about this because I had thought the push notifications were end-to-end encrypted, so they couldn't be cached in readable form by the push notification service, and only decrypted by the app on device upon receiving the notification. But it seems like after the notification was decrypted by the app and shown to the user using OS APIs, the notification text was was then stored by the OS in some kind of notification history DB locally on the device?
- saagarjha 6mo agoSomething of that sort.
- bigyabai 6mo ago> I had thought the push notifications were end-to-end encrypted Much of the metadata is plaintext, in both Apple and Google's Push Notification architecture.
- modeless 6mo agoMy understanding is that in Signal's implementation of push notifications the message text is end-to-end encrypted by Signal and decrypted on device by the Signal app. The decryption is not handled by the OS's push notification system.
- tadfisher 6mo agoIf I am reading this right, your understanding is incorrect. Signal's "new messages" push message payload is empty. Upon receiving a message of this type, the Signal app wakes up, fetches the actual messages, and (optionally) displays local notifications for them. At no point does the push message payload contain message text or metadata, encrypted or not.
- thire 6mo agoSo that means iOS is caching the local notifications, not the push event... I wonder why it was needed to begin with, especially for a month
- pixel_popping 6mo agoIn privacy circles, this was always known, as Google/Apple often sends notification content to their servers (which means that it bypass the App realm). Some people talking about it (different but in the same scope of issue): https://blog.davidlibeau.fr/push-notifications-are-a-privacy-nightmare/ https://blog.davidlibeau.fr/push-notifications-are-a-privacy...
- 6thbit 6mo agoin the case reported the content did not leave the device. feds retreived them directly from the phone.
- massel 6mo agoI expect that Signal encrypts the notification data prior to sending it to Apple, then decrypts it on-device using a Notification Service Extension – this is a common pattern to avoid trusting Apple with any sensitive data. That would mean Apple stored the cleartext on-device after decryption.
- eggnet 6mo agoSignal doesn’t provide anything in the message other than… “there are pending messages.” Signal wakes up, fetches them, then generates notifications on the phone itself.
- rvnx 6mo ago+ Messengers like Snapchat and WhatsApp; despite "end-to-end" encryption (for WhatsApp) they are sending copy of some messages based on keywords to authorities, PRISM-like. Officially to protect kids, but who knows what is in this keywords list.
- pixel_popping 6mo agoI doubt anyone who wants guarantees that their communication aren't leaked is using Whatsapp or Snapshat anyway.
- itopaloglu83 6mo agoThankfully Apple backported the fix the iOS 18 as well.
- ilikepi 6mo agoNot only that, but iOS 18.7.8 actually seems to be available to devices capable of running iOS 26 without any workarounds, unlike 18.7.3 through .6. It makes me wonder if those intermediate releases really were supposed to be available but weren't due to some issue on the distribution side that no one bothered to fix.
- itopaloglu83 6mo agoI think that was another attempt by Apple to push users to iOS 26, but after seeing how many people with compatible devices refuse to upgrade, they finally caved in and provided an update.
- lynndotpy 6mo agoThey caved, but they're still pulling out new tactics to trick users into installing iOS 26. The new iOS 18 update will _also_ toggle Automatic Updates back on. I had it happen just now on my 13 Mini against my will. I had to go back into settings and very carefully navigate to disable automatic updates.
- 6mo ago
- maerF0x0 6mo agoCat and Mouse, good. This is the adversarial setup that results in a better outcome for all.
- dlcarrier 6mo agoThis was a bug that left it cached on the device. Apple and Google have put themselves in the middle of most notifications, causing the contents to pass through their servers, which means that they are subject to all the standard warrantless wiretapping directly from governments, as well as third-party attacks on the infrastructure in place to support that monitoring. If you don't want end-to-end messages made available to others, set your notifications to only show that you have a message, not what it contains or who its from.
- gruez 6mo ago> Apple and Google have put themselves in the middle of most notifications, causing the contents to pass through their servers, which means that they are subject to all the standard warrantless wiretapping directly from governments, as well as third-party attacks on the infrastructure in place to support that monitoring. >If you don't want end-to-end messages made available to others, set your notifications to only show that you have a message, not what it contains or who its from. This incorrect on two counts: 1. As per what you wrote immediately before the quoted text, the issue was that the OS keeps track of notifications locally. Google/Apple's notification servers have nothing to do with this 2. It's entirely possible to still have end-to-end messaging even if you're forced to send notifications through Google/Apple's servers, by encrypting data in the notification, or not including message data at all. Indeed that's what signal does. Apple or Google's never sees your message in cleartext.
- mdavidn 6mo agoYou are correct, but you omitted one complication: Clients trust Google's and Apple's servers to faithfully exchange the participants' public keys.
- 6thbit 6mo agoThe "bug" discussed in the article is only part of the problem. The main problem, which is notifications text is stored on a DB in the phone outside of signal, is not addressed. To avoid that you have to change your settings. In this case, the defendant had deleted the signal app completely, and that likely internally marks those app's notifications for deletion from the DB, so the bug fixed here is that they were not removing notifications from the local database when the app that generated them was removed, now they do. Impact: Notifications marked for deletion could be unexpectedly retained on the device Description: A logging issue was addressed with improved data redaction. CVE-2026-28950 They classify this as "loggging issue" so it sounds like notifications were not actually in the database itself but ended up in some log.
- concinds 6mo agoYou're speculating. "Marked for deletion" could mean after you dismiss it, not just after you delete the whole app.
- 6thbit 6mo agoi'll speculate further: it could've been on the dismiss notification code, and when you delete the app the OS dismisses the removed app's notifications, triggering the same code path. in this case as per reporting, defendant removed the app. unclear if they first dismissed them.
- twoodfin 6mo agoSQLite WAL?
- saagarjha 6mo agoWhy do you think they aren't the same thing?
- firesteelrain 6mo agoThis tweet seems to imply it’s logs, json, plist and SQLite DB. Biome — /private/var/mobile/Library/Biome/streams/.../Notification/segments/ — the raw title/body logs 2. BulletinBoard + UserNotificationsCore — /var/mobile/Library/{BulletinBoard,UserNotificationsCore}/.{json,plist} — delivered + dismissed state 3. CoreDuet — /var/mobile/Library/CoreDuet/coreduetdClassD.db — SQLite that re-ingests Biome events https://x.com/zeroxjf/status/2047081983449178128?s=46 https://x.com/zeroxjf/status/2047081983449178128?s=46
- tcfhgj 6mo agobug or backdoor?
- 6thbit 6mo ago"Never attribute to malice that which is adequately explained by stupidity."
- varun_ch 6mo agoThis makes me wonder: Cellebrite makes tools for law enforcement to break into iPhones, likely exploiting weaknesses/vulnerabilities. Does Apple buy Cellebrite’s tools and reverse engineer them? Or would they not have a way of acquiring them legally?
- bilbo0s 6mo agoI bet Apple has access to Mythos now. Not saying they should use it to reverse engineer hacking tools. Just saying they have access to Mythos now.
- deleted 6mo ago[deleted]
- klausa 6mo agoYou bet that the company that was prominently mentioned as a parter in the announcement for a thing, has access to that thing? Wow, such a risky bet, I'm not sure it'll pay off.
- saagarjha 6mo agoCellebrite sells their lower-level devices to Apple directly for things like data transfer at Apple Stores. The ones above that are unlikely to be sold to Apple.
- tredre3 6mo ago> Cellebrite sells their lower-level devices to Apple directly for things like data transfer at Apple Stores. Please substantiate that claim. Why would Apple need mystical third party devices to transfer data? They've designed both the user devices and the software, and they're both capable of exchanging data, and I'm sure Apple can do even more once they put the devices in diagnostic mode. What am I missing? What is Cellebrite providing here?
- avianlyric 6mo ago
- lynndotpy 6mo agoHeads up. They have released an iOS 18 update (good!) but, and please bear the caps: UPDATING IOS WILL ENABLE AUTOMATIC UPDATES TO IOS 26. (Bad!) This is a new shady tactic they're using trying to get iOS 18 users to install iOS 26.
- xmx98 6mo agoThanks for the warning!
- layer8 6mo agoThis was already the case for 18.7.7. However, after turning automatic updates off in 18.7.7, after updating to 18.7.8 it remained off (reproducibly on several devices I updated). Maybe there is a one-time flag that is set so that after turning off automatic updates after having been turned on automatically, they aren't automatically turned on again on subsequent updates.
- lynndotpy 6mo agoHuh, my experience was the opposite. I don't think Apple undid my setting with iOS 18.7.7, but they did with iOS 18.7.8.
- jim33442 6mo agoAvoid iOS 26 at all costs. I was forced to update to it because I needed to factory reset my phone, and it's super buggy. I'm not even one of those people harping on the Liquid Glass design decisions, those are w/e, the problem is just that the phone routinely freaks out doing basic tasks like trying to open the camera app or close the keyboard. They should roll it back.
- skrtskrt 6mo agoIt's not new that push notifications should be presumed to be insecure, with their content passing through - and probably persisted - outside the app sandbox and anything in control of in-app encryption. Apple should have fixed this long ago (not that you can trust a closed system), but Signal should also have strong guardrails & warnings around allowing message content in push notifications.
- cubefox 6mo agoIt is completely unclear from this article whether this means Apple does no longer cache dismissed notifications somewhere.
- ashishb 6mo agoThis has nothing to do with Apple/Firebase notification service. It has to do with the fact that any notification displayed on your device goes via a separate system service which was caching them. It is amusing to see how often people confuse device notifications with Apple notification service.
- aucisson_masque 6mo ago> This was because notifications that displayed the messages’ content were also cached on the device for up to a month. Why can't we have notification history just like on Android then. It's very useful when you dismiss a notification you didn't want to, or you look for some old stuff.
- giannicmptr1000 6mo agoI like apple, but would never trust them with privacy. NYPD uses ISMI catchers and other tech. This is a nothing burger or nothing donut.
- kippinsula 6mo agoevery time something like this surfaces I'm reminded how many privacy guarantees end at the app boundary. you can do all the e2e crypto you want, the OS layer is going to do whatever it does with your strings once they hit a render path. probably an unsolvable category of bug as long as notifications need to show readable text somewhere.
- riddlemethat 6mo agoIf you want security through obscurity you can revert to IPoAC (RFC 1149).
- Razengan 6mo agoSpeech capable avians can spontaneously leak secrets
- Razengan 6mo ago> probably an unsolvable category of bug as long as notifications need to show readable text somewhere. Let screens always show garbled pixel vomit, decoded on device only by your private AR glasses
- kippinsula 6mo agothreat model just shifts to whoever has a camera pointed at your face, but probably still an improvement.
- chislobog 6mo agoLooking at the detritus in the filesystem on Jailbroken iOS devices you will observe that iOS decides to vacuum, purge, and let linger all sorts of databases and logs until something triggers a cleanup which is usually time or an iCloud sign-out induced erase and subsequent sync. People have been complaining for years about excessive phantom “system storage” and “other data.” Interestingly the photos thumbs database can grow seemingly indefinitely in size for some weeks or more if you’re regularly deleting all of your photos and saving to photos from apps or taking photos. I suspect that there a lot of behavioral data records that is left on most devices until a convenient period of inactivity passes and the possible user behavior analysis and reporting functions of iOS allow whatever cleanup happens after processing on device. It would be useful to capture iCloud backup restores from physical devices to corellium virtual devices with some creative matching of your existing idevices identifiers. Could see what triggers a cleanup during backups, local or otherwise, get a good look at what is being restored from iCloud. I also think it’s possible that iCloud can sync a database, say safari bookmarks, pushing it to the device inducing a state where the device bookmarks are moved to inaccessible tables and left there, unavailable to the end user, but not out of sync with the current active session state. Of course this is just my musing based on observations of weekly ffs extractions of a few devices over the last 5 years.
- handedness 6mo agoMy observations from when I daily drove iOS (no more) mirror yours: the incredible amount of cruft that would accumulate was astonishing. At one point I had a device that was majority full of system storage and other data. The same was true across family devices, too. Some years ago I stopped depending on Apple's purchased downloaded movies for long flights, after an instance of having the files downloaded to the device beforehand, but Apple deciding I didn't have the DRM keys to play said files during a long transoceanic flight. I then moved to storing DRM-free movies in VLC, but iOS prioritized keeping system storage and other data cruft around, and wiped VLC's stored files. Talk about paying for an expensive device and media you don't really own. I'd imagine the metadata picture that could be synthesized from that data could be extensive in some cases. This stuff is hard and I'm sure there are good reasons for caching things, especially on a device positioned to primarily act as a readily available front end for online stores, but I have a hard time believing that Apple's executing it well.
- deleted 6mo ago[deleted]
- trinsic2 6mo agoI would never rely on a closed system for secure messaging to many unknowns.
- dewey 6mo agoAnd yet iOS is probably the most secure mobile platform for secure messaging. Especially in lock down mode.
- trinsic2 6mo agoExcept, you cant really verify all of that. so IMHO that's just speculation based on the surfacing of news which can easily be distorted. Or maybe you can. Is there any sources on people that have evaluated the security of these features.
- dewey 6mo agoYou can’t verify that even on an open OS as there will still be closed hardware blobs. At least with popular systems there’s a lot of state level hacking activity so zero days get patched routinely. Also Apple has a program for researchers where they get more access to the system (That program was criticized heavily though for the way it was implemented). It’s not a perfect system so right now you still have to trust someone at some point in the chain.
- j_maffe 6mo ago> At least with popular systems there’s a lot of state level hacking activity so zero days get patched routinely Not sure how you're implying one leads to the other.
- exfil 6mo agoAgree. Peoples are trusting App with unknown source code & delivery path, infrastructure controlled by 3rd party. Application cannot protect against OS and OS cannot protect against HW. Too many known unknowns. Seek the arguments how and why OTF got re-funded last time.
- benjx88 6mo agoAnthropic Mythos at work! iOS is so good and well built that only 1 bug was found and those patch. "It's either all a joke ... or none of it is." -Bruce Banner
- mplewis 6mo agoWhat did Anthropic have to do with any of this?
- benjx88 6mo agoIt was an attempt at humor and banter, should've flag that or something.
- JumpCrisscross 6mo ago> What did Anthropic have to do with any of this? To be fair, the day after Glasswing was announced [1] iOS 26.4.1 was released [2]. Three weeks later, we have 26.4.2. When I saw the update prompt, my first thought was security fixes from Mythos. (In reality, the data do not show that Apple is releasing iOS 26 versions more frequently after Project Glasswing was announced than it was before. If we see another release in two weeks, I think we can conclude at least a statistically-meaningful signal.) [1] https://www.anthropic.com/project/glasswing https://www.anthropic.com/project/glasswing [2] https://en.wikipedia.org/wiki/IOS_26#Version_history https://en.wikipedia.org/wiki/IOS_26#Version_history
- shumatsumonobu 6mo ago[flagged]
- 650REDHAIR 6mo agoI’m frustrated that Signal isn’t notifying users about this. I disabled notifications and instead Signal reminded me to re-enable them…
- seanieb 6mo agoThe issue is only an issue if your phone is physically taken, then unlocked and the message notifications extracted from a iOS cache database. Todays update by Apple fixes issue for every app, not just Signal.
- random3 6mo agoMakes you think what’s the biggest concerns wrt Mythos — is it finding or fixing the vulnerabilities that’s scarier :))
- takihito 6mo ago[dead]
- classified 6mo agoGood. Now, are they fixing any of their other gazillion bugs?
- compounding_it 6mo agoSo for third party apps this seems like if you do e2e then along with this bug fix your texts are safe. E2E apps could be independently verified by a third party let’s say. But what about iMessage. The source code will never be available for neither the servers nor the app.
- samarth0211 6mo agoThat was definitely necessary, becuase the major reason people buy iphones is privacy and security
- gsky 6mo agohave you ever thought maybe Apple is creating a backdoor like this to make secret deals with gov orgs. trusting a valley company is the last thing you could do since there is a ton of money to be made from selling secrets
- ratg13 6mo agoI think people are too focused on the device part of it. Whatever Apple did to block access to the cache does not negate the fact that these notification messages are still being sent in plaintext through Apple and Google’s servers. It’s hard to imagine that Apple/Google couldn’t just be compelled to hand this information over if ordered by a court and wouldn’t need your phone at all. And this loophole possibly only hinges on the fact that most law enforcement maybe never realized this was something they could ask for. Or perhaps this is happening and the public just doesn’t know it yet.
- Canada 6mo agoThis is a problem with all kinds of apps. There is no discipline in the handling of user data. Take the notes app. When you delete text it not gone you can still see it in the sqlite database they use for storage. I'm sure this is so they can support sync be recording your changes as CRDTs or something. And if the app isn't leaky, the OS will probsbly screw you like in this case. The concept of being able to clean up your laptop is just not supported, you have to wipe the whole device which is ridiculous.
- immanuwell 6mo agoFinally!
- NikolaosC 6mo agoSignal deletes the message. Apple keeps the notification that shows the message. For a month. On-device. This is exactly the kind of bug that isn't a bug it's what happens when privacy is owned by the app but the OS isn't aligned.
- ChrisRR 6mo agoIt seems so weird that it caches for so long. Notifications are rare enough that you could clean it out of the cache as soon as it's dismissed. It's not like it's something that's happening every few ms
- shantnutiwari 6mo agoNice. Will Apple now also fix the "bug" where you delete a message on your phone, and 3 months later it downloads on your iPad or Watch, and you can never be sure your messages are really gone? Before anyone asks: No , I didnt turn on any setting to save all my messages to some external server and download them whenever, even if I delete them locally
- TeMPOraL 6mo agoIs it a bug or a feature though? What's more common: wanting to delete a message and have it stay gone, or accidentally deleting the message you wanted to preserve? For most people the latter is more likely than the former.
- notTheLastMan 6mo agoDear... Apple users really have a different level of loyalty than anyone else.
- TeMPOraL 6mo agoI don't use or own any Apple devices, and don't play to. But mobile space is a duopoly, and both sides tend to implement the same questionable ideas in lockstep, so developments here will likely affect Android users like myself just as much.
- DetroitThrow 6mo agoWhat on Earth? No, normal users actually also want to permanently delete messages all of the time. There's not some alternate reality where the all of people's actions need to be automatically ctrl-Z'd on their behalf without any input.
- Unsponsoredio 6mo ago[dead]
- Fokamul 6mo agoWho cares, Apple as any other US company must cooperate with "cops" or 3-letter agencies. Not publicly, of course. Ask yourself, do you really own your device? Can you access kernel? Can you flash your own firmware on your device? No? Then you DON'T own it.
- jameshart 6mo agoApple has repeatedly shown - as in this case - that when police are able to find a way to use their subpoena and coercive powers over Apple to subvert a user’s privacy expectations and extract data from an iPhone, that they see that as a failing of iOS and are willing to fix that bug. In this case they are patching out a data extraction path that was exploited to access data a user thought had been deleted.
- joshrw 6mo ago“Bug”. More like a “bugdoor”
- hurricanepootis 6mo agoI've used something like this before on my Samsung S24 to see a deleted text from Signal. I checked the notification history and the text was there. Fortunately, Signal has an option to make it where notifications don't actually have the message in it. However, the receiver has to enable that option.
- j45 6mo agoA discussion about enshittification might enjoy a late 2025 book about enshittification. https://www.goodreads.com/en/book/show/222376640-enshittification https://www.goodreads.com/en/book/show/222376640-enshittific...
- fragmede 6mo agoThe most frustrating part about this is that evidently there's a database of notifications, so that notification that you dismissed and didn't see is totally a thing iOS could have like Android does but they just don't wanna do that for some reason.