Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI used iPhone notification data to retrieve deleted Signal messages

9to5mac.com

Post reply on HN
Print view View original

281–290 of 322 posts

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#281

Post by pxeboot »

alfiedotwtf wrote: post #268
microtonal wrote: post #237

Earlier quoted context omitted.

I think one of the main issues is that end-to-end message encryption is a sham as long as backups are not encrypted. I could have good device security, but if the person I'm talking to does not use ADP, iMessage and WhatsApp messages get backed up with only at-rest encryption (I think Signal opts out of standard iOS backups) and possibly the same for backups of the iPhone notification database (which the article sugg…

This is what I’ve always hated with Apple Time Machine, which I think MUST have been deliberate: - create an encrypted disk - install Mac OS on the encrypted disk - use Time Machine to back it up with encrypt turned on All good so far. Ok, time to restore: - Restore from Time Machine - enjoy your PLAIN TEXT install :poo:

This isn't really an issue anymore. All M series Macs (and T2?) are always encrypted by default.

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#282

Post by heisenbit »

fmx wrote: post #274

Perhaps a stupid question, but why do notifications need to be stored in a database in persistent storage at all? OK, maybe they can be stored until they're dismissed in case the battery suddenly dies, so they can be displayed again on next boot and are not lost, but it sounds like they are being stored long after they are dismissed.

I suspect they live in a database and are eventually going where GC data goes.

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#283

Post by satvikpendem »

gertop wrote: post #221
satvikpendem wrote: post #170

Earlier quoted context omitted.

Sure but it needs to go through Firebase regardless of the content of the notification message, I do not believe there is a way to use a third party notification service which does not depend on Firebase.

Any application can send notifications without going through a server.

How? I'm not talking about an application backend server but a notification server which Google and Apple have for all apps. I'm not sure besides polling or having a persistent connection to send notifications to an app while that app is not running.

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#284

Post by satvikpendem »

eptcyka wrote: post #229
satvikpendem wrote: post #170

Earlier quoted context omitted.

Sure but it needs to go through Firebase regardless of the content of the notification message, I do not believe there is a way to use a third party notification service which does not depend on Firebase.

When running Signal without google play services, Signal reliably received push notifications and with minimal battery drain.

Do you have microG? That provides a compatibility layer for FCM.

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#285

Post by GeekyBear »

greysonp wrote: post #278
GeekyBear wrote: post #265

Earlier quoted context omitted.

> Oh, you did turn on disappearing messages? We send the messages in notifications. So the OS can keep them. Worse than that, they did not take advantage of the ability to send that message data as an encrypted payload inside the notification. https://blog.davidlibeau.fr/push-notifications-are-a-privacy... Either do not include sensitive user data inside a notification by default, or encrypt that data before you send…

Signal developer here. Our FCM and APN notifications are empty and just tell the app to wake up, fetch encrypted messages, decrypt them, and then generate the notification ourselves locally.

That's certainly a better state of affairs.

So you just need to fix the default setting and not display the message text in notifications to prevent this issue in the future?

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#286

Post by amethyst »

ransom1538 wrote: post #267
upofadown wrote: post #180

Putting on my user hat... "OK. Signal has forward secrecy. So messages are gone after I receive them. Great!" Oh, you didn't turn on disappearing messages? Oh, right, then forensic tools like Cellebrite can get them. You have to turn on disappearing messages. The default is off. Oh, you did turn on disappearing messages? We send the messages in notifications. So the OS can keep them. Turns out Apple was doing that. T…

0) send a public key. 1) encrypt the file with your private key 2) send file. WTF. This is super simple stuff.

3) recipient stores decrypted content in plain text and backs that up in well-known cloud storage systems

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#288

Post by lo_zamoyski »

microtonal wrote: post #237
upofadown wrote: post #180

Putting on my user hat... "OK. Signal has forward secrecy. So messages are gone after I receive them. Great!" Oh, you didn't turn on disappearing messages? Oh, right, then forensic tools like Cellebrite can get them. You have to turn on disappearing messages. The default is off. Oh, you did turn on disappearing messages? We send the messages in notifications. So the OS can keep them. Turns out Apple was doing that. T…

I think one of the main issues is that end-to-end message encryption is a sham as long as backups are not encrypted. I could have good device security, but if the person I'm talking to does not use ADP, iMessage and WhatsApp messages get backed up with only at-rest encryption (I think Signal opts out of standard iOS backups) and possibly the same for backups of the iPhone notification database (which the article sugg…

> the tech companies can wash their hands in innocence

Hostile defaults, not just in tech, is how Western liberal soft power often works. They can always claim "hey, you have the choice", but they know very well most people won't even know they have the choice, or is it so cumbersome or costly to move away from the hostile defaults - and stay that way - that in practice, the effect is the same as if you lived in a totalitarian regime. The difference is that you can keep believing in the deception of "freedom" in a Western liberal society; in a totalitarian regime, you are much more likely to know you've got a jackboot on your throat, because there is one.

What is needed isn't radical liberal atomistic individualism which rationalizes the antisocial war of all against all that rewards raw might. You won't find freedom there. You need a culture of respect of and sense of duty toward the authentic common good, backed by moral authority, where authority is power + justice.

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#289

Post by dwedge »

fn-mote wrote: post #219
benhurmarcel wrote: post #125

Earlier quoted context omitted.

Reminds me what Whatsapp if you set up a 2FA PIN, which forces you to type it about every week to check if you forgot it. So annoying.

Sorry, I really cannot tell if this is sarcasm or not. One of the TOTP apps had a periodic test that you still knew the paraphrase. It started frequent and then backed off to like once a month. There’s definitely a benefit even if it’s annoying.

That app was authy by Twilio. Twilio screwed over everyone using that app

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#290

Post by lolc »

satvikpendem wrote: post #266
Zak wrote: post #264

Earlier quoted context omitted.

It's theoretically possible to just keep an app running in the background all the time and periodically poll a server. That's unreliable though since some OEM Android builds will kill it for that even if the user disables battery optimizations. Those OEMs sort of have a point; if lots of apps did that it would drain the battery fast.

Then that's basically what I said right? That there is in practice no way to opt out of using Firebase if you want consistent notifications.

Not clear what your point is. The Signal server wakes up the app via an empty message. At most the info this conveys is that a Signal app got a message to pull.
Post reply on HN