51–54 of 54 posts
So would I be correct to say the distributor is a a 3rd party "satellite" app, that your app pulls from and the notification server pushes to? So end users would need to install this distributor app in addition to your own app?
OT: anyone have experience with pushover.net, if so - how is it?
I have a Octoprint integration which lets me know when 3d prints have completed.
You can also modify the priority of a message, so I can send "critical" events if I need to, although I use that rarely.
In this direct to FCM model, does the application running on the untrusted user's device need to embed any sensitive credentials? What prevents someone else from impersonating my app or other users on my app?
If you are interested, you can read the specifications: https://unifiedpush.org/developers/spec/android/ . The same question actually exists for firebase-messaging (Google) too (answer here: https://github.com/firebase/firebase-android-sdk/blob/cf5fe2... )
The application may embed the VAPID public key while the VAPID private key is kept secret by the app developer. That way only the app developer can send valid push notifications. This approach doesn't work when the app running on an untrusted device sends push notifications directly though?
I guess the trick is for the app to treat the push notification purely as a hint to go fetch the latest state from the app server. Do not trust anything in the push notification message. Then it doesn't matter whether the messages are spoofed.
You linked to some Android Intents code in the firebase-message code. I guess that is related to preventing Intent spoofing, but I'm not sure?
Earlier quoted context omitted.
> Except it doesn't? See how I introduced your case later with "Alternatively"? You saw it since you quoted me. Fine, your email app works well in fetch mode. It took you three roundtrips to mention your actual setup despite having been asked about it quite early and despite it being a critical element in this discussion. Omitting to mention that doing this choice, your notifications are delayed. Fetch mode is totall…
I mean, my point with E-mail is to say it already IS a solved problem. Many services and apps use E-Mail so there is no need to setup additional infrastructure unlike push notifications. That is the complexity. Send an email notifying me to test@example.com is more intuitive than setting up a push service. Push notifications suffer from deliverability more frequently (regularly expiring tokens) than E-mail so much so…
"hey, I just arrived at the restaurant!" You may want to know this now