2 ms·
This is misinformation, and is false. For many apps, they choose to do it this way. For most e2ee apps, they do not. The notification displayed on screen doe
by sneak 6mo ago
This is misinformation, and is false.
For many apps, they choose to do it this way. For most e2ee apps, they do not. The notification displayed on screen does not need to be the notification pushed through APNS.
- Permik 6mo agoBut in the real world, for maximal battery savings and therefore UX, routing any notification data via APNS is recommended. Fortunately you can choose the payload by yourself and just send a notification "ping" without any data about the messages. But if we're serious about security, you just don't ping the client about new messages because even the time and existence of a notification can be compromising. _The user will know that they got a message, when they open the app and see that they got a new message._
- sneak 6mo agoRouting e2ee notification data via APNS is fine, it’s no different than routing e2ee notification data via HTTPs. Your ISP sees the outer ciphertext in both cases (APNS is also mTLS).