this post was submitted on 04 Jun 2025
291 points (99.3% liked)

Privacy

38498 readers
508 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
k_o_t@lemmy.ml
tmpod@lemmy.pt
Yayannick@lemmy.ml
ranok@sopuli.xyz
291
Apple Gave Governments Data on Thousands of Push Notifications (www.404media.co)
submitted 2 days ago by sabreW4K3@lazysoci.al to c/privacy@lemmy.ml
57 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] Isaac@waterloolemmy.ca 21 points 2 days ago (5 children)

It’s paywalled for me so can’t see this all. But does this mean signal, rcs and other encrypted messages are being logged? Kind of defeats the purpose of privacy based use cases if so

[–] dev_null@lemmy.ml 6 points 1 day ago* (last edited 1 day ago) (1 children)

A push notification, from a technical standpoint, is just a way to wake up an app. It doesn't have to contain any information.

So when you get a message, the messaging service sends a push notification through Apple/Google, which is a way of saying "Hey messaging app, wake up". The app then starts running in the background on your phone, connects to it's server, asks if there is anything new to know about, and the server tells it about a new message, if any. This can then generate a notification on your phone, but importantly what you are seeing in the notification did not come through Apple/Google, all that did was the "Hey messaging app, wake up!".

If authorities then request this data from Apple/Google, all they can see is the times at which your messaging app was asked to wake up. Not whether any message was actually received, or what it contained, or from who. Because all that never touched Apple/Google's systems, not even in an encrypted form.

That being said, some data can be sent directly through the Apple/Google system along with the wake up message, so it's not impossible that some apps include some metadata there. In theory they shouldn't. For example simple marketing notifications or ads often are just included with the push, because it's simple to do.

[–] Ulrich@feddit.org 1 points 17 hours ago* (last edited 15 hours ago) (1 children)

all they can see is the times at which your messaging app was asked to wake up. Not whether any message was actually received, or what it contained, or from who.

Here's what Senator Ron Wyden had to say on the matter:

The data these two companies receive includes metadata, detailing which app received a notification and when, as well as the phone and associated Apple or Google account to which that notification was intended to be delivered. In certain instances, they also might also receive unencrypted content, which could range from backend directives for the app to the actual text displayed to a user in an app notification.

So they know:

  • What app received the notification
  • when it was received
  • who it was sent to
[–] dev_null@lemmy.ml 1 points 17 hours ago (1 children)

I don't know, are they? As far as we know they could only get unsent notifications, which are obviously still with Apple/Google because the target phone is offline and so they couldn't be delivered yet. Which would explain why they only got thousands of them, not billions.

[–] Ulrich@feddit.org 23 points 2 days ago* (last edited 2 days ago) (1 children)

Yes. 100%. Some app creators will encrypt the contents but I don't think they can encrypt the metadata.

Even the most "private" of companies like Signal and Proton don't provide any alternative either. Third-party fork Molly adds UnifiedPush support to Signal.

From Signal CEO:

PSA: We've received questions about push notifications. First: push notifications for Signal NEVER contain sensitive unencrypted data & do not reveal the contents of any Signal messages or calls–not to Apple, not to Google, not to anyone but you & the people you're talking to.

In Signal, push notifications simply act as a ping that tells the app to wake up. They don't reveal who sent the message or who is calling (not to Apple, Google, or anyone). Notifications are processed entirely on your device. This is different from many other apps.

What's the background here? Currently, in order to enable push notifications on the dominant mobile operating systems (iOS and Android) those building and maintaining apps like Signal need to use services offered by Apple and Google.

Apple simply doesn’t let you do it another way. And Google, well you could (and we've tried), but the cost to battery life is devastating for performance, rendering this a false option if you want to build a usable, practical, dependable app for people all over the world.

So, while we do not love Big Tech choke points and the control that a handful of companies wield over the tech ecosystem, we do everything we can to ensure that in spite of this dynamic, if you use Signal your privacy is preserved.

(Note, if you are among the small number of people that run alt Android-based operating systems that don't include Google libraries, we implement the battery-destroying push option, and hope you have ways to navigate.)

https://mastodon.world/@Mer__edith/111563865413484025

[–] jasonthedragon442@lemmy.ml 10 points 2 days ago (2 children)

PSA: We've received questions about push notifications. First: push notifications for Signal NEVER contain sensitive unencrypted data & do not reveal the contents of any Signal messages or calls–not to Apple, not to Google, not to anyone but you & the people you're talking to.

Doesn't this mean there is nothing to log? You got me confused

[–] icelimit@lemmy.ml 12 points 2 days ago (1 children)

I guess it's possible to log the fact that a push notification was received and the time of it?

[–] jasonthedragon442@lemmy.ml 2 points 1 day ago* (last edited 13 hours ago) (1 children)

Honestly I wouldn't expect Signal to try and take care of this

[–] Ulrich@feddit.org 1 points 17 hours ago

They could, very easily, by implementing UnifiedPush. Let the users decide if they want/need to use it. But as of now the only way to do that is by installing a third-party app.

[–] Ulrich@feddit.org 8 points 2 days ago* (last edited 2 days ago) (1 children)

Not necessarily. I'm not some sort of tech genius but she's using some choice language here:

push notifications for Signal NEVER contain sensitive unencrypted data & do not reveal the contents of any Signal messages

metadata is not "contained" in the notification.

When pushed on this she basically changed the subject to "there's no alternative":

Another Twitter user pointed out that rather than the exposure of the text, the bigger issue is that “the push gets sent at all, not what’s in it. It lets an attacker identify somebody by when they get messages, messages the attacker may even have sent.”

To this, Whittaker replied, “So this is an issue worth clarifying. It’s not possible [right now] to build a mass [communications] app [without] push notifications, [especially with] calling. This is a problem, we agree.”

https://www.medianama.com/2023/12/223-signal-push-notifications-content-meredith-whittaker/

I could be misinterpreting these statements but that's how it reads to me. Seems like encrypting metadata would require Google's involvement and I'm sure that's the opposite of what they want.

[–] dev_null@lemmy.ml 1 points 17 hours ago* (last edited 17 hours ago) (1 children)

You are trying to read what isn't there. Push notifications just don't contain any messages, at all, in any form, whether you want to call it data or metadata. They are just telling the Signal app to wake up, and then it securely checks with the server what's up.

The only think authorities are getting then, is the fact your Signal app was told to wake up at time X. Not whether you actually received a message, let alone any information about any messages.

It is confusing the system is called "push notifications", because it has nothing to do with the actual notifications you are seeing on your phone. It's just a mechanism to wake up sleeping apps so that they can check up with their server.

[–] Ulrich@feddit.org 1 points 17 hours ago (1 children)

The only think authorities are getting then, is the fact your Signal app was told to wake up at time X

That's called metadata.

It's just a mechanism to wake up sleeping apps so that they can check up with their server.

So why do the authorities want it?

[–] dev_null@lemmy.ml 2 points 17 hours ago (1 children)

Yes it's called metadata. I don't know why they want it.

[–] Ulrich@feddit.org 1 points 16 hours ago (1 children)

It's because it's used in tandem with other data they collect to profile you. To profile all of us.

[–] dev_null@lemmy.ml 2 points 16 hours ago

Yes, I assume so.

[–] plz1@lemmy.world 12 points 2 days ago

Signal is E2EE. While it does use notifications, there is no meaningful unencrypted content in them. The content of the notification you see is decrypted on-device.

[–] irotsoma@lemmy.blahaj.zone 3 points 2 days ago

Yes, these are not "private" services, they are "secure messaging" services. Commonly confused issue. Privacy requires controlling the communication infrastructure. Security only requires controlling the items being shared.