Post B57b2KNxF0v1cQKnPk by natty@astolfo.social
(DIR) More posts by natty@astolfo.social
(DIR) Post #B57amh76yCgPTa0A88 by phillip@social.lol
0 likes, 0 repeats
RE: https://infosec.exchange/@josephcox/116374994792773696To stop leaking your Signal messages:Signal > Settings > Notifications > Notification Content > Show > “Name only” or “No name or content”iOS and Android notifications all go through Apple and Google’s servers respectively and are not end to end encrypted. The feds have known and used this for years now.#privacy #PrivacyMatters #cybersecurityRT: https://infosec.exchange/users/josephcox/statuses/116374994792773696
(DIR) Post #B57amhPXrfQcOkcsrY by becomethewaifu@tech.lgbt
0 likes, 0 repeats
@phillip Two entirely unrelated things, though the notification settings mitigation may close this particular hole. (Depends on whether it's the app or the OS acting on those settings) This particular issue has nothing to do with "unified push" and concerns only an internal detail of iOS, where notifications are stored in a local on-device file outside of the signal app, which the phone also has to be jailbroken to access.Signal already mitigates "unified push" to the point it exposes nothing to google/apple other than "this user possibly received a message." They only send a push to 'wake up' the app to fetch the content directly from signal's servers, with no content exposed (because they can't expose the content to apple/google, as they don't know it themselves)
(DIR) Post #B57amhe4zd3R7pQUW8 by natty@astolfo.social
0 likes, 0 repeats
@becomethewaifu@tech.lgbt @phillip@social.lol Push notifications are also encrypted and/or empty and just tell the phone to pull the content so I am very confused. Especially WebPush
(DIR) Post #B57b2KNxF0v1cQKnPk by natty@astolfo.social
0 likes, 0 repeats
@becomethewaifu@tech.lgbt @phillip@social.lol And especially in Signal where it's E2EE lmao, how would it even send sensitive notifications to servers?