Discussion
FBI used iPhone notification data to retrieve deleted Signal messages
frizlab: Aren’t notifications supposed to be encrypted for Signal?
makosdv: You can choose what to show in the notification and there is an option to include the message, so I'm guessing that allowed some unencrypted incoming messages to be read.
butvacuum: it seems iOS will drop previews into an unencrypted section. which, Is how I expected iOS notification previews to work without unlocking the phone
frizlab: Sibling comment explains. The notification does arrive encrypted and is decrypted by an app extension (by Signal), however, if the message preview is shown, it is stored unencrypted by iOS. It is that storage that is accessed.
lenerdenator: There needs to be a bit more "group chat" control in Signal messages, wherein you could enforce certain settings for certain chats regardless of the phone settings. You could have group chats that would enforce not showing more information in the notifications, while others would still allow it.
preinheimer: This feels like it would run against the “I bought my device, I should control how it behaves” line of thinking.
krisknez: This kind of vulnerability is not tied to Signal but all apps which send notification.
chinathrow: On Android, when I use WhatsApp and have notifications for groups turned off, I can still see that they arrive briefly and then get removed (the icon top left vanishes). I wonder often, if this is a way to push all group message content into an unencrypted data trace as well - for the same use case.
kome: signal is security theater, and a very bad user experience
i_am_proteus: Reminder that no end-to-end encryption arrangement can do anything before encryption, or after decryption, at the endpoints.
windowliker: Right. It's purely a protection against MitM snooping. The app has to have the messages in plaintext to display to you via whatever mechanism the OS uses. Seems obvious, but also not, at the same time.I've found several ways Signal can leak information, even with disappearing messages. It's not the total install-and-be-done privacy screen that some people think it is, and requires some effort at the user end to fill in a few gaps.
kome: smartphones in general runs against the “I bought my device, I should control how it behaves” line of thinking
jonpalmisc: Settings > Notifications > Notification Content > Show: "Name Only" or "No Name or Content"I've had this enabled to prevent sensitive messages from appearing in full whilst showing someone something on my phone, but I guess this is an added benefit as well.
jhalstead: Fwiw, in my Signal app on Android this setting is inSettings > Notifications > Messages > Show
etiam: But it would be pretty well in line with the "I trust my contact with this communication, but only if they're not systematically misled to copy it to readily exploitable insecure storage" line of thinking.Since the purposes of the program are pretty heavy on private communication, I'm inclined to think that takes precedence here, especially considering the consequences for dropping default message previews versus adding default reveal of supposedly private information.
chasil: First, a critical setting for Signal users:"Signal’s settings include an option that prevents the actual message content from being previewed in notifications. However, it appears the defendant did not have that setting enabled, which, in turn, seemingly allowed the system to store the content in the database."Second, how can I see this notification history?
jhalstead: On a Pixel, I can see some history by going toAndroid > Notifications > Manage > Notification HistoryI don't know if that's what's being referred to in the article though.
arkon_hn: If the notification has the data, then yes. It's trivial to create an app that listens to notifications; Samsung even has one themselves called NotiStar that replicates the notification history feature that Android normally has.
mnls: People who NEED to hide their notifications from iOS have this already disabled.They rest who "evaluate their threat models" can practice Spy-life-gymnastics by disabling it from Signal.
xandrius: Victim blaming?
embedding-shape: I guess enabling Lockdown mode might avoid this particular issue too, together with a bunch of other stuff?
everdrive: Why would lockdown mode prevent this? I have lockdown mode on but that doesn't automatically make my notifications private.
alsetmusic: Original article: FBI Extracts Suspect’s Deleted Signal Messages Saved in iPhone Notification Database[0]0. https://www.404media.co/fbi-extracts-suspects-deleted-signal...
blitzar: > testimony in a recent trialCourt cases are the real way to audit security.Larping about security and complaining about companies responding to court orders only gets you so far. Its way more useful to look at what actually happens in reality.
tbrownaw: The recent Trivy / LiteLLM mess was also a security thing, and seems rather different.
nickburns: Just to clarify, this is within the Signal app settings—not the OS (iOS or Android) system settings.Critical distinction, as merely changing OS notification settings will simply prevent notification content from being displayed on-screen.
hammock: Wait so if I do iOS setting notifications > never show previews it’s still caching them in the background? Unencrypted?
nickburns: [delayed]
helpfulclippy: I think it fits in pretty well with Signal. As it stands, a group chat can control when a message is automatically deleted for everyone, so everyone can rely on that being a shared setting. That's an intentional design decision. There's no individual opt-out.An individual can disable name or content in notifications in iOS, or set "mute messages" for a chat to prevent notifications from appearing for that specific chat, but there's nothing that gives group members any assurance that other group members are doing that.
nashashmi: [delayed]
wolvoleo: My Samsung also keeps a history of notification content. Under Settings->Notifications ->Advanced -> Notification History
tialaramex: However, if this is important to you then you want Signal to stop telling Android to make the notifications. If it doesn't exist nobody will accidentally make it available.Deleting that history is good to know about after the fact, but preferably lets just not create the problem.
tbrownaw: That's unfortunately less informative if you aren't already one of their subscribers.
gabeio: https://archive.is/bSQhD You can view their link here.
JumpCrisscross: Signal should switch the default to being less verbose.
nickburns: [delayed]
gruez: >it's even worse than that. What's additionally happening is they're still 'syncing' back to Apple servers via APNS (and to Alphabet servers via Firebase on Android)—even with notifications completely disabled, that's correct.Source? I don't think either OS implements notification syncing between devices, it's only one way, and as others have mentioned, the actually push notification doesn't contain any message content, only an instruction for signal to fetch and decrypt the message.
nixosbestos: Um. Android has notification history also and I see no similar ability to hide notification content from the system ...
cdrnsf: Disable Apple Intelligence summaries for sensitive app notifications too.
huxley: Given the quality of the summaries, you might want to keep them just for plausible deniability </s>
echelon_musk: As an aside, I decrypted an encrypted iPhone backup using a tool from GitHub because I wanted easy access to my Voice Memo recordings.Photos I had long deleted were still in the backup! It's quite surprising just how much is being stored by the phone.
embedding-shape: It's a mode of the phone that is supposed to prevent cyber attacks, more so than "normal mode" I suppose, since it's supposed to limit features in the name of security. This seems like a variant of such attack, so seems like it should protect against it
jonpalmisc: There is a documented list of things that Lockdown Mode affects [1], this is not one of the advertised ones. There are a bunch of other (undocumented) things it affects (some of which are bugs :/), but I don't believe it has any affect on notification storage.[1] https://support.apple.com/en-us/105120
normie3000: Mostly it seems the documentation is vague. Is there anything clearer than this?> Web browsing: Certain complex web technologies are blocked, which might cause some websites to load more slowly or not operate correctly. In addition, web fonts might not be displayed, and images might be replaced with a missing image icon.
namdnay: yes, since apple doesn't control the content of the pushes it is sent by application backends. that can only be controlled within each app
schrodinger: This sounds correct. When I implemented push notifications for an iPhone application, I remainder needing to obtain a store a separate token for each device a user has, and subscribing to a feed of revoked delivery tokens. Seemed like an interesting design intended to facilitate E2E encryption for push notifications.
throawayonthe: They are;“Messages were recovered from Sharp’s phone through Apple’s internal notification storage—Signal had been removed, but incoming notifications were preserved in internal memory. Only incoming messages were captured (no outgoing).”ie the messages recovered were 1. incoming 2. stored by the OS after decryptioni also was spooked by the headline :p
shantara: iOS stores the previously displayed notifications in an internal database, which was used to access the data. It’s outside of Signal’s control, they recommend disabling showing notification content in their settings to prevent this attack vector
exitb: They do control the content on the notification. It's a bit odd to put the sensitive text in the notification only to recommend disabling it at the system level.
kccqzy: No. They recommended disabling it at the app level. Only the Signal app can control whether the message contents are included in the notifications.
6thbit: So this is where we find out the one end of e2e is the phone and not the app.Semi-related, in whatsapp reading the text in the notification doesn't mark the message as read, so the OS is kinda mitm here.
zenoprax: Signal creates the notification, does it not? That's like claiming `echo "my_private_data" | notify-send` is insecure.If piping encrypted content resulted in a plaintext notification then you'd have a right to be concerned.
kmbfjr: With notifications disabled APNS push notifications fail for the sending app backend. The device id is rendered invalid if push notifications are disabled at any point. Backends are supposed to handle this and quit sending messages.Signal has this setting to tell the backend how much information to put into the push message. It can tell the backend to send a simple notification saying “new message” and not send information through APNS or enable it.I am willing to bet Signal has a notification extension to handle edge cases where there is lag in settings to scrub the message metadata before it dings a screen alert.
