Oh hey it's one of Signal's main vulnerabilities again @rysiek@szmer.info
We've known about this for a long time. Google too. Apple publishes it in their transparency reports now.
I was going to say why is this news now? This was a big thing at the end of 2023. Like they even mentioend it in the article.
The practice first came to light in 2023 when Senator Ron Wyden sent a letter to the U.S. Department of Justice
Data breaches should always be news, even if it is unsurprising to you personally. There's literally always going to be someone out there who doesn't have the same information that you do.
Edit: yes, I do think it ought to be considered a data breach when data is shared with additional parties, even (or maybe especially) when that party is the government.
but the apple fanboys tell me their phone is private!
And the secure “lockdown” mode on iOS disables push notifications for exactly this reason. But the vast majority of people don’t use lockdown mode in their day to day, because it kills a lot of the functionality of the phone. Lockdown mode is intended for people who may actually be targeted by laser-focused hacking attempts. Politicians, celebrities, people with high security clearance, etc… It’s not something that the average person would use.
Apple even publishes this as a known vulnerability. It’s due to the way push notifications work. Similar to SMS, push notifications default to unencrypted because there isn’t a single unified system. Each carrier and cell manufacturer handles push notifications differently, so they’re kept unencrypted so that the public encryption key doesn’t get lost during transit; That would just result in scrambled junk messages.
I got news for you. Google does this too. Have a great day.
yes. we all know.
apple fanboys are the people who don't think this shit happens to them.
the only halfway private smartphones are unlocked androids that can be used with a degoogled OS. and even then.
apple fanboys are the people who don't think this shit happens to them.
I say this as an Apple hater: this is a false narrative. Apple fanboys say that their devices are more private, not completely private, and they are (assuming a stock Android OS). That's not really up for debate. The mistake you're making is positing privacy as a binary concept. Privacy is a spectrum.
How dare you ruin their narrative
GrapheneOS user joined the chat
It’s paywalled for me so can’t see this all. But does this mean signal, rcs and other encrypted messages are being logged? Kind of defeats the purpose of privacy based use cases if so
Yes. 100%. Some app creators will encrypt the contents but I don't think they can encrypt the metadata.
Even the most "private" of companies like Signal and Proton don't provide any alternative either. Third-party fork Molly adds UnifiedPush support to Signal.
From Signal CEO:
PSA: We've received questions about push notifications. First: push notifications for Signal NEVER contain sensitive unencrypted data & do not reveal the contents of any Signal messages or calls–not to Apple, not to Google, not to anyone but you & the people you're talking to.
In Signal, push notifications simply act as a ping that tells the app to wake up. They don't reveal who sent the message or who is calling (not to Apple, Google, or anyone). Notifications are processed entirely on your device. This is different from many other apps.
What's the background here? Currently, in order to enable push notifications on the dominant mobile operating systems (iOS and Android) those building and maintaining apps like Signal need to use services offered by Apple and Google.
Apple simply doesn’t let you do it another way. And Google, well you could (and we've tried), but the cost to battery life is devastating for performance, rendering this a false option if you want to build a usable, practical, dependable app for people all over the world.
So, while we do not love Big Tech choke points and the control that a handful of companies wield over the tech ecosystem, we do everything we can to ensure that in spite of this dynamic, if you use Signal your privacy is preserved.
(Note, if you are among the small number of people that run alt Android-based operating systems that don't include Google libraries, we implement the battery-destroying push option, and hope you have ways to navigate.)
PSA: We've received questions about push notifications. First: push notifications for Signal NEVER contain sensitive unencrypted data & do not reveal the contents of any Signal messages or calls–not to Apple, not to Google, not to anyone but you & the people you're talking to.
Doesn't this mean there is nothing to log? You got me confused
I guess it's possible to log the fact that a push notification was received and the time of it?
Honestly I wouldn't expect Signal to try and take care of this
They could, very easily, by implementing UnifiedPush. Let the users decide if they want/need to use it. But as of now the only way to do that is by installing a third-party app.
Not necessarily. I'm not some sort of tech genius but she's using some choice language here:
push notifications for Signal NEVER contain sensitive unencrypted data & do not reveal the contents of any Signal messages
metadata is not "contained" in the notification.
When pushed on this she basically changed the subject to "there's no alternative":
Another Twitter user pointed out that rather than the exposure of the text, the bigger issue is that “the push gets sent at all, not what’s in it. It lets an attacker identify somebody by when they get messages, messages the attacker may even have sent.”
To this, Whittaker replied, “So this is an issue worth clarifying. It’s not possible [right now] to build a mass [communications] app [without] push notifications, [especially with] calling. This is a problem, we agree.”
https://www.medianama.com/2023/12/223-signal-push-notifications-content-meredith-whittaker/
I could be misinterpreting these statements but that's how it reads to me. Seems like encrypting metadata would require Google's involvement and I'm sure that's the opposite of what they want.
Signal is E2EE. While it does use notifications, there is no meaningful unencrypted content in them. The content of the notification you see is decrypted on-device.
Removed archive link, also paywalled.
:(
Articles Found:
A push notification, from a technical standpoint, is just a way to wake up an app. It doesn't have to contain any information.
So when you get a message, the messaging service sends a push notification through Apple/Google, which is a way of saying "Hey messaging app, wake up". The app then starts running in the background on your phone, connects to it's server, asks if there is anything new to know about, and the server tells it about a new message, if any. This can then generate a notification on your phone, but importantly what you are seeing in the notification did not come through Apple/Google, all that did was the "Hey messaging app, wake up!".
If authorities then request this data from Apple/Google, all they can see is the times at which your messaging app was asked to wake up. Not whether any message was actually received, or what it contained, or from who. Because all that never touched Apple/Google's systems, not even in an encrypted form.
That being said, some data can be sent directly through the Apple/Google system along with the wake up message, so it's not impossible that some apps include some metadata there. In theory they shouldn't. For example simple marketing notifications or ads often are just included with the push, because it's simple to do.
all they can see is the times at which your messaging app was asked to wake up. Not whether any message was actually received, or what it contained, or from who.
Here's what Senator Ron Wyden had to say on the matter:
The data these two companies receive includes metadata, detailing which app received a notification and when, as well as the phone and associated Apple or Google account to which that notification was intended to be delivered. In certain instances, they also might also receive unencrypted content, which could range from backend directives for the app to the actual text displayed to a user in an app notification.
So they know:
I don't know, are they? As far as we know they could only get unsent notifications, which are obviously still with Apple/Google because the target phone is offline and so they couldn't be delivered yet. Which would explain why they only got thousands of them, not billions.
Yes, these are not "private" services, they are "secure messaging" services. Commonly confused issue. Privacy requires controlling the communication infrastructure. Security only requires controlling the items being shared.
Apple’s transparency reports are interesting to look at, though I think the last update was June 2024.
Here’s the latest update for the US.
This sounds like news but it is not. It is also not unique to apple. If you use push notifications on any platform you’re susceptible to this.
Push notifications are often unencrypted beacons that are used by cops to corroborate surveillance between devices even when the content transferred between devices isn’t available or incriminating.
It’s the old “you say you weren’t involved but call records indicate you communicated with the suspect despite being in another county at the time of the crime” but updated to digital. When cops want cause for a warrant or some kind of wiretap they use push notifications to establish it.
If you’re doing crimes or whatever, turn off push notifications. They can be used to establish that you communicated with someone or that you were in a specific area.
Again, this is not unique to apple devices.
And that is why we use ntfy :)
Not the main instance ofc because then you have one big silo again, but there are plenty of publicly hosted servers.
Selfhosted gotify rules
Would be great if app publishers actually made it available. To my knowledge there are only 2 or 3.
Didn't we already go through this Google?
It is amazing how these companies design these services in a way that enables them to view the contents. They act as if they own the device you paid for. And most people will just accept this.
Part of that is the responsibility of the app developer, since they define the payload that appears in the APNs push message. It’s possible for them to design it such that the push message really just says “time to ping your app server because something changed”. That minimizes the amount of data exposed to Apple, and therefore to law enforcement.
For instance the MDM protocol uses APNS. It tells the device that it’s time to reach out to the MDM server for new commands. The body of the message does not contain the commands.
That still necessarily reveals some metadata, like the fact that a message was sent to a device at a particular time. Often metadata is all that law enforcement wants for fishing expeditions. I think we should be pushing back on law enforcement’s use of broad requests (warrants?) for server data. We can and should minimize the data that servers have, but there’s limits. If servers can hold nothing, then we no longer have a functional Internet. Law enforcement shouldn’t feel entitled to all server data.
Thank you for expanding my understanding on this topic. Very insightful.
Thousands, you say? gasp
Exactly. Out of the trillions that they probably process every day, over several years, they only had to turn over “thousands”. If the government can find a bunch of loopholes to get what they want, then that’s hardly the fault of Apple.
If the worst you can say about Apple is that they still, very rarely, are forced to turn over data to the government due to bureaucratic loopholes and are no fault of their own, then I still stand behind them.
And if they got anything useful out of that data? Then it is the fault of the actors for not properly encrypted their data when they have the opportunity.
Both google and apple designed notification services that enble spying on your activities on the device.
Also, that's the requests that were done by "law enforcement"
Anything "national security" won't be reported there.
The story here is that mega corps collect this information. This information can be used against you.
Don't be naive.
It’s hilarious that you could equate, Google and Apple as both being evil, even though Apple specifically and explicitly keeps all of its specific and private user data private, and it always has. Apple has even gone up against the FBI and the Supreme Court in United States on several locations to maintain their ability to obvious skate and anonymize specific user data.
But, I know let me love to hate on Apple, regardless of if it’s even true, so hate on!
Of course, if you have any meaningful evidence of the contrary, go on and present it. Let’s see what silly excuses you use to rationalize murder. I’m very interested!
I'm actually surprised this came up again. Wasn't this a thing back like a year and a half ago or something as well? I remember a big push to get on unified push about then.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
much thanks to @gary_host_laptop for the logo design :)