Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ntfy.sh – Send push notifications to your phone via PUT/POST

ntfy.sh

Post reply on HN
Print view View original

131–140 of 306 posts

Re: Ntfy.sh – Send push notifications to your phone via PUT/POST

#131

Post by flir »

EGreg wrote: post #87
krono wrote: post #44

From the FAQ[1]: > Will you know what topics exist, can you spy on me? > If you don't trust me or your messages are sensitive, run your own server. This is the way. No pinky promises in whitepaper format[2] that leave out the most important bits, no meticulously constructed but entirely meaningless marketing statements[3][4], but unassuming and deferential logic with a mitigation path. 1: https://ntfy.sh/docs/faq/#wi…

Why not end to end encrypt notifications with a public key? Both iOS and Android can run a completionHandler to decrypt them using a private key that can be stolen if the app is disassembled. But you can generate a private key per user, after install, and each mailbox publisjes a public key. The thing I find ironic is that the actual encryption is done in JS, which is served by a webserver so anyway you have to trust…

Could the app not take a copy of the per-user private key when it's generated? (I know nothing about mobile security models).

Re: Ntfy.sh – Send push notifications to your phone via PUT/POST

#132

Post by pastage »

phaer wrote: post #101
krn wrote: post #93

Earlier quoted context omitted.

Well, thinking logically: if everyone really got what they wanted, that question wouldn't be in the FAQ, would it?

Especially with things like notifications, even e2e encryption can't generally provide complete privacy because metadata is data too ;)

You solve that by forwarding/decrypting/adding noise between servers, enough to cover metadata traffic you generate. The only data you reveal is anyone listening know you might have used it at some point. See https://vuvuzela.io/ I suspect it is named so because it uses a lot of bandwidth.

Re: Ntfy.sh – Send push notifications to your phone via PUT/POST

#133

Post by binwiederhier »

ilyt wrote: post #66
jsiepkes wrote: post #49

Earlier quoted context omitted.

Even if you disable battery optimization it's going to depend on your phone if it will actually honor it (and not kill the app). This site: https://dontkillmyapp.com/ shows which phones behave correctly.

And if you change the settings that will make your phone behave nicely it often severely impacts battery life ;/

We've done some battery work a couple of months ago and since then I've not really had any complaints from the thousands of users, so I think overall it's working.

Every now and then there is some oddball phone that keeps killing connections and such, but it's very very rare. I think we've optimized it to the best of what's possible at the moment.

Re: Ntfy.sh – Send push notifications to your phone via PUT/POST

#134

Post by djbusby »

flir wrote: post #131
EGreg wrote: post #87

Earlier quoted context omitted.

Why not end to end encrypt notifications with a public key? Both iOS and Android can run a completionHandler to decrypt them using a private key that can be stolen if the app is disassembled. But you can generate a private key per user, after install, and each mailbox publisjes a public key. The thing I find ironic is that the actual encryption is done in JS, which is served by a webserver so anyway you have to trust…

Could the app not take a copy of the per-user private key when it's generated? (I know nothing about mobile security models).

Or when you paste in a key to the app to use for decrypt.

Not specific to mobile. Give an app data and it can do what it wants.

Re: Ntfy.sh – Send push notifications to your phone via PUT/POST

#135

Post by binwiederhier »

pfoof wrote: post #96

Thank you. Finally I don't have to set up some crazy email auth or build a special app to get info from my pipelines or raspberry

You're welcome. Comments like this make me so happy.

BTW if you _do_ want to send emails, ntfy can do that too, even without auth (limited to 16 a day though): https://ntfy.sh/docs/publish/#e-mail-notifications

Re: Ntfy.sh – Send push notifications to your phone via PUT/POST

#136

Post by adamckay »

shivam543 wrote: post #107
binwiederhier wrote: post #35

Earlier quoted context omitted.

End to end encryption is already fully designed and partially implemented. I just had a baby and have no time to do it recently: https://github.com/binwiederhier/ntfy/issues/69

If I run ntfy behind NGINX reverse proxy which is on https, isn't that E2E encrypted due to https?

No, because your Nginx server decrypts that TLS connection so can access the plaintext data. This is typically called encrypted-in-transit.

E2EE means that it's always encrypted from the sending device to the receiving device and nothing in the middle (including the service operator) can read it.

Re: Ntfy.sh – Send push notifications to your phone via PUT/POST

#137

Post by donatzsky »

shivam543 wrote: post #107
binwiederhier wrote: post #35

Earlier quoted context omitted.

End to end encryption is already fully designed and partially implemented. I just had a baby and have no time to do it recently: https://github.com/binwiederhier/ntfy/issues/69

If I run ntfy behind NGINX reverse proxy which is on https, isn't that E2E encrypted due to https?

E2E implies that the data itself gets encrypted by the sender and is only decrypted by the receiver. With https, the "pipe" is encrypted, but the data is not and the server will get the plain-text.

Re: Ntfy.sh – Send push notifications to your phone via PUT/POST

#138

Post by binwiederhier »

kirimita wrote: post #89
atentaten wrote: post #80

Could this potentially replace Firebase Cloud Messaging for push notifications?

It is an UnifiedPush distributor, so it can replace FCM for applications supporting it. Here are most of the applications supporting UnifiedPush right now: https://unifiedpush.org/users/apps/

This is the way. UnifiedPush is sllooowly becoming more popular. Element (Matrix chat app) just added official support for it, which is super cool. And you can use ntfy as a distributor.

Re: Ntfy.sh – Send push notifications to your phone via PUT/POST

#139

Post by Ajedi32 »

EGreg wrote: post #87
krono wrote: post #44

From the FAQ[1]: > Will you know what topics exist, can you spy on me? > If you don't trust me or your messages are sensitive, run your own server. This is the way. No pinky promises in whitepaper format[2] that leave out the most important bits, no meticulously constructed but entirely meaningless marketing statements[3][4], but unassuming and deferential logic with a mitigation path. 1: https://ntfy.sh/docs/faq/#wi…

Why not end to end encrypt notifications with a public key? Both iOS and Android can run a completionHandler to decrypt them using a private key that can be stolen if the app is disassembled. But you can generate a private key per user, after install, and each mailbox publisjes a public key. The thing I find ironic is that the actual encryption is done in JS, which is served by a webserver so anyway you have to trust…

Ultimately there's no way around having the trust the client. The state of the art on that front right now is open source code with reproducible builds[1] and binary transparency[2].

Unfortunately none of that is currently implementable on the web for the reason you cited; the web server can just replace the entire application with any code it wants when you refresh the page. One possible path to fixing that is web packaging[3], but those standards are still in their infancy and don't yet have a mechanism for enforcing binary transparency.

[1]: https://reproducible-builds.org/

[2]: https://developers.google.com/android/binary_transparency

[3]: https://wicg.github.io/webpackage/draft-yasskin-wpack-use-ca...

Re: Ntfy.sh – Send push notifications to your phone via PUT/POST

#140

Post by teekert »

This is great, will add it to my docker-compose.yaml and my scripts!

To be clear, if 100 people subscribe to ntfy.sh/mytopic, they all receive this message, right?

    curl -d "Backup successful :)" ntfy.sh/mytopic
I wonder how many people got one when I was testing...
Post reply on HN