Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI used iPhone notification data to retrieve deleted Signal messages

9to5mac.com

Post reply on HN
Print view View original

51–60 of 322 posts

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#51

Post by helpfulclippy »

preinheimer wrote: post #13
lenerdenator wrote: post #10

There needs to be a bit more "group chat" control in Signal messages, wherein you could enforce certain settings for certain chats regardless of the phone settings. You could have group chats that would enforce not showing more information in the notifications, while others would still allow it.

This feels like it would run against the “I bought my device, I should control how it behaves” line of thinking.

I think it fits in pretty well with Signal. As it stands, a group chat can control when a message is automatically deleted for everyone, so everyone can rely on that being a shared setting. That's an intentional design decision. There's no individual opt-out.

An individual can disable name or content in notifications in iOS, or set "mute messages" for a chat to prevent notifications from appearing for that specific chat, but there's nothing that gives group members any assurance that other group members are doing that.

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#52

Post by hammock »

nickburns wrote: post #28
jonpalmisc wrote: post #14

Settings > Notifications > Notification Content > Show: "Name Only" or "No Name or Content" I've had this enabled to prevent sensitive messages from appearing in full whilst showing someone something on my phone, but I guess this is an added benefit as well.

Just to clarify, this is within the Signal app settings—not the OS (iOS or Android) system settings. Critical distinction, as merely changing OS notification settings will simply prevent notification content from being displayed on-screen.

Wait so if I do iOS setting notifications > never show previews it’s still caching them in the background? Unencrypted?

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#53

Post by nickburns »

hammock wrote: post #52
nickburns wrote: post #28

Earlier quoted context omitted.

Just to clarify, this is within the Signal app settings—not the OS (iOS or Android) system settings. Critical distinction, as merely changing OS notification settings will simply prevent notification content from being displayed on-screen.

Wait so if I do iOS setting notifications > never show previews it’s still caching them in the background? Unencrypted?

Yes. And technically, from a privacy perspective, it's even worse than that. What's additionally happening is they're still 'syncing' back to Apple servers via APNS (and to Alphabet servers via Firebase on Android)—even with notifications completely disabled, that's correct.

If the app generates them, the OS receives them. That's why the Signal app offers this setting.

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#54

Post by foooorsyth »

shalmanese wrote: post #30

I thought Signal didn’t show message previews by default and you had to go in and enable it? I’ve never had message previews in my Signal and I don’t remember changing anything. Maybe when they introduced the feature, you could pick but they strongly suggested it not showing?

The opposite, actually. Signal endlessly nags you to turn on notifications, and when you turn them on, previews and content are shown by default. You cannot opt out of the nags.

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#56

Post by jonpalmisc »

embedding-shape wrote: post #47
everdrive wrote: post #31

Earlier quoted context omitted.

Why would lockdown mode prevent this? I have lockdown mode on but that doesn't automatically make my notifications private.

It's a mode of the phone that is supposed to prevent cyber attacks, more so than "normal mode" I suppose, since it's supposed to limit features in the name of security. This seems like a variant of such attack, so seems like it should protect against it

There is a documented list of things that Lockdown Mode affects [1], this is not one of the advertised ones. There are a bunch of other (undocumented) things it affects (some of which are bugs :/), but I don't believe it has any affect on notification storage.

[1] https://support.apple.com/en-us/105120

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#57

Post by phyzome »

mnls wrote: post #20

People who NEED to hide their notifications from iOS have this already disabled. They rest who "evaluate their threat models" can practice Spy-life-gymnastics by disabling it from Signal.

What a goofy comment.

The article you're commenting on is about people who obviously would have wanted this disabled, but didn't have it disabled, presumably because they didn't know about this issue.

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#58

Post by nickburns »

JumpCrisscross wrote: post #45
nickburns wrote: post #28

Earlier quoted context omitted.

Just to clarify, this is within the Signal app settings—not the OS (iOS or Android) system settings. Critical distinction, as merely changing OS notification settings will simply prevent notification content from being displayed on-screen.

Signal should switch the default to being less verbose.

The default should be "No name or content".

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#59

Post by rustyhancock »

everdrive wrote: post #31
embedding-shape wrote: post #27

Earlier quoted context omitted.

I guess enabling Lockdown mode might avoid this particular issue too, together with a bunch of other stuff?

Why would lockdown mode prevent this? I have lockdown mode on but that doesn't automatically make my notifications private.

Lockdown mode would prevent access to the data in theory.

But most likely (pure speculation mind you), this was a case of someone handing over the phone for review and where cooperating.

It might have been that they deleted signal some time ago, or even deleted signal and then handed over the phone.

It's notable that the data wasn't recovered from signals storage (was the data securely erased or that kind of recovery not attempted?).

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#60

Post by 0x62 »

SergeAx wrote: post #55

Probably stupid question: why won't they e2e-encrypt push notifications too? The vector is obvious and has been open since forever.

Signal does not send any sensitive information in push notifications sent via APNs [0]. This story concerns the local OS cache of push notifications, which are triggered after E2E decryption has occurred.

[0] https://mastodon.world/@Mer__edith/111563865413484025

Post reply on HN