FBI used iPhone notification data to retrieve deleted Signal messages • Hacker News Board

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#71

Post by gruez » Fri, Apr 10, 2026, 1:45 PM UTC

nickburns wrote: post #53

hammock wrote: post #52

Earlier quoted context omitted.

Wait so if I do iOS setting notifications > never show previews it’s still caching them in the background? Unencrypted?

Yes. And technically, from a privacy perspective, it's even worse than that. What's additionally happening is they're still 'syncing' back to Apple servers via APNS (and to Alphabet servers via Firebase on Android)—even with notifications completely disabled , that's correct. If the app generates them, the OS receives them. That's why the Signal app offers this setting.

>it's even worse than that. What's additionally happening is they're still 'syncing' back to Apple servers via APNS (and to Alphabet servers via Firebase on Android)—even with notifications completely disabled, that's correct.

Source? I don't think either OS implements notification syncing between devices, it's only one way, and as others have mentioned, the actually push notification doesn't contain any message content, only an instruction for signal to fetch and decrypt the message.

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#72

Post by tbrownaw » Fri, Apr 10, 2026, 1:48 PM UTC

SergeAx wrote: post #55

Probably stupid question: why won't they e2e-encrypt push notifications too? The vector is obvious and has been open since forever.

The "e" in e2e encryption is a computing device, not the device's user's brain.

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#73

Post by gruez » Fri, Apr 10, 2026, 1:49 PM UTC

niek_pas wrote: post #33

I wonder why Apple doesn't 'just' delete the notification data associated with the app from the internal database when the user deletes the app? It seems like asking for problems to just keep old notification content around forever.

If the "database" works like most other databases (eg. postgres or sqlite), deleting a row doesn't immediately cause the data to be wiped from disk, for performance reasons. Then as others mentioned you have filesystem/SSD logic that does something similar on top of that.

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#74

Post by namdnay » Fri, Apr 10, 2026, 1:50 PM UTC

hammock wrote: post #52

nickburns wrote: post #28

Earlier quoted context omitted.

Just to clarify, this is within the Signal app settings—not the OS (iOS or Android) system settings. Critical distinction, as merely changing OS notification settings will simply prevent notification content from being displayed on-screen.

Wait so if I do iOS setting notifications > never show previews it’s still caching them in the background? Unencrypted?

yes, since apple doesn't control the content of the pushes it is sent by application backends. that can only be controlled within each app

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#75

Post by normie3000 » Fri, Apr 10, 2026, 1:53 PM UTC

jonpalmisc wrote: post #56

embedding-shape wrote: post #47

Earlier quoted context omitted.

It's a mode of the phone that is supposed to prevent cyber attacks, more so than "normal mode" I suppose, since it's supposed to limit features in the name of security. This seems like a variant of such attack, so seems like it should protect against it

There is a documented list of things that Lockdown Mode affects [1], this is not one of the advertised ones. There are a bunch of other (undocumented) things it affects (some of which are bugs :/), but I don't believe it has any affect on notification storage. [1] https://support.apple.com/en-us/105120

Mostly it seems the documentation is vague. Is there anything clearer than this?

> Web browsing: Certain complex web technologies are blocked, which might cause some websites to load more slowly or not operate correctly. In addition, web fonts might not be displayed, and images might be replaced with a missing image icon.

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#76

Post by TeMPOraL » Fri, Apr 10, 2026, 1:55 PM UTC

nixosbestos wrote: post #70

Um. Android has notification history also and I see no similar ability to hide notification content from the system ...

Good. The moment they add it, all kinds of apps will start to abuse it, for "sekhurity" (read: engagement) reasons. See e.g. all the apps that now disallow taking screenshots, for no legitimate reason.

Personally I'd be in favor of a hard app store policy, that if an app notifies you about something, all the importantdetails (like full message text) must be included - specifically to allow the user to view the important information without having to open the app itself.

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#77

Post by boysenberry » Fri, Apr 10, 2026, 1:56 PM UTC

echelon_musk wrote: post #68

As an aside, I decrypted an encrypted iPhone backup using a tool from GitHub because I wanted easy access to my Voice Memo recordings. Photos I had long deleted were still in the backup! It's quite surprising just how much is being stored by the phone.

What did you use?

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#78

Post by frizlab » Fri, Apr 10, 2026, 1:56 PM UTC

exitb wrote: post #67

shantara wrote: post #4

Earlier quoted context omitted.

iOS stores the previously displayed notifications in an internal database, which was used to access the data. It’s outside of Signal’s control, they recommend disabling showing notification content in their settings to prevent this attack vector

They do control the content on the notification. It's a bit odd to put the sensitive text in the notification only to recommend disabling it at the system level.

They do not. They send encrypted notifications. It’s the OS that stores them unencrypted. It’s the OS at fault here IMHO.

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#79

Post by 6thbit » Fri, Apr 10, 2026, 1:57 PM UTC

So this is where we find out the one end of e2e is the phone and not the app.

Semi-related, in whatsapp reading the text in the notification doesn't mark the message as read, so the OS is kinda mitm here.

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#80

Post by zenoprax » Fri, Apr 10, 2026, 2:02 PM UTC

6thbit wrote: post #79

So this is where we find out the one end of e2e is the phone and not the app. Semi-related, in whatsapp reading the text in the notification doesn't mark the message as read, so the OS is kinda mitm here.

Signal creates the notification, does it not? That's like claiming `echo "my_private_data" | notify-send` is insecure.

If piping encrypted content resulted in a plaintext notification then you'd have a right to be concerned.