• bearboiblake [he/him]@pawb.social
    link
    fedilink
    English
    arrow-up
    2
    ·
    3 months ago

    It always bears repeating, push notifications are not private, neither for Android, GrapheneOS, nor iOS, even if you use end-to-end encryption. If you are privacy conscious, you should either use settings to hide sensitive data from push notifications or turn them off altogether.

    • MrSoup@lemmy.zip
      link
      fedilink
      English
      arrow-up
      1
      ·
      edit-2
      3 months ago

      If you turn off notification history on Android, should be enough to avoid such “attacks”. Hiding sensitive content inside notifications only hides it in the lock screen. If your OS keeps a clear log of them, it’s useless.

      Edit: didn’t know Signal actually has settings to hide their own notifications. I was thinking about Android’s “hide sensitive content” setting.

      • 4am@lemmy.zip
        link
        fedilink
        English
        arrow-up
        1
        ·
        3 months ago

        Notifications go through FireBase Cloud Messaging (FCM) on Android. They bounce off a Google server. Even from local, on-device apps.

        Same with iOS.

        They can read and store every one of them, and you don’t control the encryption keys.

        • Björn@swg-empire.de
          link
          fedilink
          English
          arrow-up
          2
          ·
          3 months ago

          But they only instruct Signal to wake up and download whatever is waiting. They don’t contain the message contents.

          • bearboiblake [he/him]@pawb.social
            link
            fedilink
            English
            arrow-up
            0
            ·
            3 months ago

            If you don’t use Google Play Services, you don’t get push notifications, so yes. Libre reimplementations of Google Play Services such as Gapps etc. or alternative push notification providers do not circumvent this issue, except possibly self-hosted push notification providers. This approach is really rare though and limited generally to very few apps.

            • frongt@lemmy.zip
              link
              fedilink
              English
              arrow-up
              0
              arrow-down
              1
              ·
              3 months ago

              If I turn off notifications on my end, does the other person still generate a push notification when they send me a message, even if I never receive it?

              • bearboiblake [he/him]@pawb.social
                link
                fedilink
                English
                arrow-up
                0
                ·
                3 months ago

                Edit: Sorry, I think I misunderstood your question. If you don’t have Google Play Services enabled but your friend does and messages you, no, a push notification won’t be sent, but if you message them, one will be sent to them.

                I thought you were asking if you just disabled notifications on your phone if that would prevent push notifications from being sent. I’ll leave my original answer in case someone else has that question.


                It depends on what exactly you mean, but usually not. If you mean in your phone’s notifications management settings, that does not affect the push notifications being sent to Google/Apple servers, that’s just a local setting to decide how your phone handles it.

                Some apps, though rarely, allow you to disable push notifications from being sent. If it exists, this is inside a settings screen in the app itself or on the app provider’s website somewhere. Generally, only privacy-conscious apps provide such settings.

                • frongt@lemmy.zip
                  link
                  fedilink
                  English
                  arrow-up
                  0
                  arrow-down
                  1
                  ·
                  3 months ago

                  So how does it decide to generate a push notification or not?