Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI used iPhone notification data to retrieve deleted Signal messages

9to5mac.com

Post reply on HN
Print view View original

221–230 of 322 posts

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#221

Post by gertop »

satvikpendem wrote: post #170
greysonp wrote: post #115

Earlier quoted context omitted.

Signal developer here. Not entirely sure what you're saying. I'm only an Android guy, but FCM messages are certainly one trigger that can allow an app process to run, but it's not the only trigger. You can schedule system alarms, jobs, etc. And the notification does not need to be provided by the FCM message. In our case, the server just sends empty FCM messages to wake up the app, we fetch the messages ourselves fro…

Sure but it needs to go through Firebase regardless of the content of the notification message, I do not believe there is a way to use a third party notification service which does not depend on Firebase.

Any application can send notifications without going through a server.

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#222

Post by 1vuio0pswjnm7 »

1vuio0pswjnm7 wrote: post #95

"However, it appears the defendant did not have that setting enabled, which, in turn, seemingly allowed the system to store the content in the database." "[A]llowing the system to store the content in the database" where a third party, such as Apple or a government, can access it is the default Only a small minority of users know about settings and how to change them. The vast majority of users do not change default…

Imagine a parallel universe where stories about use of personal computers were written from a different perspective. For example,

"However, it appears Apple's system uses a default setting which, in turn, seemingly allowed it to store the defandant's content in Apple's database"

instead of

"However, it appears the defendant did not have that setting enabled which, in turn, seemingly allowed the system to stoire the content in the database"

In the later version, the defendant, namely his inaction in not changing a default setting, appears solely responsible for the outcome. And the actor that placed a copy of his incoming messages in a database that the actor created is referred to as "the system", not the corporation that wrote the system and sold the computer with this system pre-instaalled

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#224

Post by 6thbit »

zenoprax wrote: post #80
6thbit wrote: post #79

So this is where we find out the one end of e2e is the phone and not the app. Semi-related, in whatsapp reading the text in the notification doesn't mark the message as read, so the OS is kinda mitm here.

Signal creates the notification, does it not? That's like claiming `echo "my_private_data" | notify-send` is insecure. If piping encrypted content resulted in a plaintext notification then you'd have a right to be concerned.

Exactly yes, and that is insecure here because the app relayed the message beyond its layer and ownership. Thus not making the app the end of the communication.

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#225

Post by xvector »

opan wrote: post #142
well_ackshually wrote: post #64

Earlier quoted context omitted.

thank god whatsapp doesn't do that either. or telegram. or allo back in the day, or every single mobile first messaging app The only one I can think of that doesn't require a mobile login is iMessage, because it's not a chat app, it's lock in and data theft disguised as software

XMPP and Matrix don't require a phone number and have fine mobile apps.

And there's a reason they've achieved precisely zero penetration amongst normies.

A chat app is useless if your friends and family won't use it.

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#226

Post by amazingman »

sillysaurusx wrote: post #203
commandersaki wrote: post #99

Earlier quoted context omitted.

So I wonder about this. The quote from the 404 media article [0] is: “We learned that specifically on iPhones, if one’s settings in the Signal app allow for message notifications and previews to show up on the lock screen, [then] the iPhone will internally store those notifications/message previews in the internal memory of the device,” a supporter of the defendants who was taking notes during the trial told 404 Medi…

I think that’s a little nutty. People go to signal for secure messaging. That’s their entire brand. An insecure by default setting is the wrong setting, even if it nets them a lot of tech illiterate users. Compromising the security of the system defeats the entire point of using Signal instead of some other messenger. By this logic, you, me, and everyone else using the defaults are using bad opsec. Doesn’t that strik…

"Security" is not a binary, but a spectrum along which there are various tradeoffs. The vendor attempts to select the best configuration for its average/median user, and that's almost by definition not going to be the most secure configuration (see: tradeoffs).

I do think there should be some UI somewhere that allows for locking all things down to the most secure configuration possible.

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#227

Post by shooly »

sillysaurusx wrote: post #208
esseph wrote: post #102

Earlier quoted context omitted.

> Only a small minority of users know about settings and how to change them. I couldn't believe this so went to look up some data on this. Holy FUCK that is bleak. There needs to be way more computer education , not just "how2type" classes.

Unfortunately, users don’t want to learn. They want the app to do what they want. Anything involving learning is likely to get an instant “screw this” reaction. Seen it firsthand many times, and always found it mystifying.

[flagged]

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#228

Post by gertop »

nine_k wrote: post #109
1vuio0pswjnm7 wrote: post #95

"However, it appears the defendant did not have that setting enabled, which, in turn, seemingly allowed the system to store the content in the database." "[A]llowing the system to store the content in the database" where a third party, such as Apple or a government, can access it is the default Only a small minority of users know about settings and how to change them. The vast majority of users do not change default…

If you care about security at all, you disable any previews on the lock screen. The lock screen is by definition visible to anyone without any authorization. Showing anything on it immediately destroys any secrecy. It must be obvious to anyone capable of elementary logic inference. If you don't know how to disable it, you use your favorite search engine / LLM / knowledgeable relative to find out, and disable it. But…

Disabling notification preview in the operating system settings doesn't prevent the issue, they're still saved in the database.

The only way they're not saved is to disable name/content in signal itself.

Maybe you're not as capable of elementary logical inference as you thought?

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#229

Post by eptcyka »

satvikpendem wrote: post #170
greysonp wrote: post #115

Earlier quoted context omitted.

Signal developer here. Not entirely sure what you're saying. I'm only an Android guy, but FCM messages are certainly one trigger that can allow an app process to run, but it's not the only trigger. You can schedule system alarms, jobs, etc. And the notification does not need to be provided by the FCM message. In our case, the server just sends empty FCM messages to wake up the app, we fetch the messages ourselves fro…

Sure but it needs to go through Firebase regardless of the content of the notification message, I do not believe there is a way to use a third party notification service which does not depend on Firebase.

When running Signal without google play services, Signal reliably received push notifications and with minimal battery drain.

Re: FBI used iPhone notification data to retrieve deleted Signal messages

#230

Post by sillysaurusx »

shooly wrote: post #227
sillysaurusx wrote: post #208

Earlier quoted context omitted.

Unfortunately, users don’t want to learn. They want the app to do what they want. Anything involving learning is likely to get an instant “screw this” reaction. Seen it firsthand many times, and always found it mystifying.

[flagged]

Mind reading the rules and leaving more substantive comments? Ideally ones with less “you”s.

Obviously the cause is different interests. Different interests can explain everything from a bad decision to going to sleep early. It says nothing useful.

Post reply on HN