[nickburns]

Just to clarify, this is within the Signal app settings—not the OS (iOS or Android) system settings.

Critical distinction, as merely changing OS notification settings will simply prevent notification content from being displayed on-screen.

[hammock]

Wait so if I do iOS setting notifications > never show previews it’s still caching them in the background? Unencrypted?

[nickburns]

Yes. And technically, from a privacy perspective, it's even worse than that. What's additionally happening is they're still 'syncing' back to Apple servers via APNS (and to Alphabet servers via Firebase on Android)—even with notifications completely disabled, that's correct.

If the app generates them, the OS receives them. That's why the Signal app offers this setting.

[gruez]

>it's even worse than that. What's additionally happening is they're still 'syncing' back to Apple servers via APNS (and to Alphabet servers via Firebase on Android)—even with notifications completely disabled, that's correct.

Source? I don't think either OS implements notification syncing between devices, it's only one way, and as others have mentioned, the actually push notification doesn't contain any message content, only an instruction for signal to fetch and decrypt the message.

[dataflow]

> I don't think either OS implements notification syncing between devices

Can't speak for iOS and no idea if this relates to the above functionality, but Pixel lets you deduplicate notifications across Pixel devices.

[pxeboot]

> I don't think either OS implements notification syncing between devices

iOS does. This is how you can receive Signal notifications on your Apple Watch and other Apple devices that don’t have the app installed.

[schrodinger]

This sounds correct. When I implemented push notifications for an iPhone application, I remainder needing to obtain a store a separate token for each device a user has, and subscribing to a feed of revoked delivery tokens. Seemed like an interesting design intended to facilitate E2E encryption for push notifications.

[jerlam]

I do wonder how notifications that are synced/mirrored to the Apple Watch and newer versions of Mac are handled.

[aftbit]

Wait... why does Signal need to send notification content to Firebase to trigger a push notification on device? I would instead expect that Signal would send a push to my Android saying nothing more than "wake up, you've got a message in convo XYZ", then the app would take over and handle the rest of it locally.

I also didn't realize that Android stores message history even after I've replied or swiped them away. That's nuts - why!?

[llacane]

Signal does NOT send notification content througth APN/Firebase, their push notification is literaly a ping as you expected.

Source: https://mastodon.world@Mer__edith/111563866152334347 (Meredith Whittaker is the current CEO of Signal)

I can't link you rigth now to the actual code on their repo but it is verifiable.

[baby]

Btw I clicked your mastodon link and it didnt work

[opan]

https://mastodon.world/@mer__edith/111563866152334347

[satvikpendem]

If your app needs to send a notification while it's not currently a running process, it must go through Firebase on Google's side and APNS on Apple's side. There is no way for a non running app to send a notification entirely locally, this is by design of both companies.

[greysonp]

Signal developer here. Not entirely sure what you're saying. I'm only an Android guy, but FCM messages are certainly one trigger that can allow an app process to run, but it's not the only trigger. You can schedule system alarms, jobs, etc. And the notification does not need to be provided by the FCM message. In our case, the server just sends empty FCM messages to wake up the app, we fetch the messages ourselves from the server, decrypt them, and build the notification ourselves. No data, encrypted or otherwise, is ever put into the FCM payloads.

[satvikpendem]

Sure but it needs to go through Firebase regardless of the content of the notification message, I do not believe there is a way to use a third party notification service which does not depend on Firebase.

[9dev]

> […] this is by design of both companies.

This is more of a fundamental technical limitation of operating systems and networks; I don't think it is possible to design distributed communication between arbitrary service provider infrastructure and end-user devices without an always-online intermediary reachable from anywhere (a bouncer, in IRC terms) that accepts messages for non-present consumers.

[satvikpendem]

Yes, however the fact that it is not customizable is what is annoying, you are forced to rely only on the OS makers' implementations, which I guess should be expected in the day and age.

[vlovich123]

> this is by design of both companies.

I’ll note that whatever other reasons it’s also the only way to make this battery efficient. Having a bunch of different TCP connections signaling events at random times is not what you want.

Ideally the app also is responsible for rendering rather than having to disclose the message but that can be challenging to accomplish for all sorts of reasons).

[OptionOfT]

But there is a way to do this encrypted, so that when the notification is received on your iPhone, the process itself needs to decrypt it.

Except you need an entitlement for that, because it requires that your app has the ability to receive a notification without actually showing it (Apple checks this).

Your app gets woken up, decrypts the message, and then shows a local notification.

[izacus]

Android doesn't store message history unless you explicitly enable that feature and neither does Signal send message content to Firebase.

You're angry about a huge amount of outright misinformation here.

[kmbfjr]

With notifications disabled APNS push notifications fail for the sending app backend. The device id is rendered invalid if push notifications are disabled at any point. Backends are supposed to handle this and quit sending messages.

Signal has this setting to tell the backend how much information to put into the push message. It can tell the backend to send a simple notification saying “new message” and not send information through APNS or enable it.

I am willing to bet Signal has a notification extension to handle edge cases where there is lag in settings to scrub the message metadata before it dings a screen alert.

[tayk47999]

Any idea if this works the same or differently for Hidden apps specifically?

Normally no notifications are shown for hidden apps, and even if you unhide the apps, prior notifications which were sent do not reappear IIRC. I'm curious if notifications like that are still hitting the phone into the notifications database, or get silently dropped, or something else.

[alfiedotwtf]

Sad to think there is a PostIt note somewhere in Virginia and written on it is a box labelled Signal, with an arrow pointing to a box labelled Apple servers, followed by a smirking smiley face pointing between the boxes with the message “encryption added and removed here”

[namdnay]

yes, since apple doesn't control the content of the pushes it is sent by application backends. that can only be controlled within each app

[JumpCrisscross]

Signal should switch the default to being less verbose.

[avidiax]

They should also signal your counterparty's security posture.

Basically, give you a heads up that the other side has settings that make the system less secure.

[Terr_]

I'd prefer the receiving end looks at sender's metadata on the message, and uses that to determine where the line is between recipient-convenience and betrayal.

I suppose you could do both, but "Hey I've got something extra important to send you, but it says need to change your settings first please hurry" seems worse than "sometimes I don't get full notifications on my watch, weird."

[nickburns]

The default should be "No name or content".

[JumpCrisscross]

Name only strikes me as a fairer compromise between security and usability.

[loeg]

I thought name-only was the default.

[JumpCrisscross]

> I thought name-only was the default

At least for me, it was name and content.

[loeg]

I may be misremembering, or it may have changed; I've been using Signal from the early days.

[stavros]

No it shouldn't. That makes the UX much worse, just to guard against the 0.00001% case where the FBI seizes your iPhone.

[iknowstuff]

Not really, that would discourage use by normies.

[fragmede]

users should switch to simpleX

[wodenokoto]

When you put it up against each other it makes perfect sense, but I would never have thought about it in that way!

Thank you for adding this to the conversation.