and on some level it’s important for good opsec that things that don’t require opsec be done with good opsec

I imagine that the signal devs viewed it as a similar concern as when you mistype your password the error message doesn’t give you any way to know if the password is wrong or if the account doesn’t exist.

If only some of your notifications are sanitized then those are the suspicious ones. If all of your notifications are sanitized then none of them are suspicious. Or, at least, they’re all equally suspicious, opaque, and unidentifiable.

You most certainly do. I looked in my notification history in my founding of signal messages.

Then I turned off my notification history.

as far as i know signal uses Google’s notification service and if you want it to not you need to use Molly

there’s a lot of things under fascism that shouldn’t be needed

I think on android, signal do not use Google’s push notification. They simple send a dummy push, and the signal app wakes up to retrive the latest message directly from signal server.

So Google never have your notification content. I am not sure if they do the same on iOS.

That being said if your attack model includes people reading your notification lock screen, then you should disable showing signal notification.

The only way apple is seeing it is when the notification is displayed. It only sees the contents of the notification itself. So it would still see who sent you a message, but it wouldn’t say what it was

It’s not because of push notifications. the message is not sent to firebase, just a signal that the app should do a refresh.

It’s because the system saves the notifications apps posted to the notification menu.

but yes. don’t use firebase push notifications if you can avoid it. use a unifiedpush based system. base signal app does not support it, only molly. there are some difficulties though with that that are unique to signal.

Signal has supported this for many years. Users can choose full content notifications, name only, or no-content notifications.

That’s not the problem here. Showing a notification with content is not a big deal.

In the case stated here, the big deal is that the notification HISTORY was preserved after removal of Signal. That’s because both Apple and Google do the same thing. They keep a notification history. Not on a per-app basis, ALL apps notification history is stored.

I know that on Androids, it is turned off by default and you can turn it on, so you get the impression that Android doesn’t have this issue. I am going to guess as I do not own an apple anything that iOS has notification history turned on by default. This is the real problem. This is not anything Signal can control for unless they were to not support notifications which would render their app useless, so that’s not an option.

Because it’s FAANG

A lot of notifications originate off your device.

As I already replied om one of your other comments:

It’s not because of push notifications. the message is not sent to firebase, just a signal that the app should do a refresh.

Is is 100% because of firebase. Here is an example payload from firebases official document:

{
  "message":{
    "token":"bk3RNwTe3H0:CI2k_HHwgIpoDKCIZvvDMExUdFQ3P1...",
    "notification":{
      "title":"Portugal vs. Denmark",
      "body":"great match!"
    }
  }
}

https://firebase.google.com/docs/cloud-messaging/customize-messages/set-message-type

Notification history is purely local to the device. It is not sent to any servers.

It’s not because of push notifications. the message is not sent to firebase, just a signal that the app should do a refresh.

Is is 100% because of firebase. Here is an example payload from firebases official document:

{
  "message":{
    "token":"bk3RNwTe3H0:CI2k_HHwgIpoDKCIZvvDMExUdFQ3P1...",
    "notification":{
      "title":"Portugal vs. Denmark",
      "body":"great match!"
    }
  }
}

https://firebase.google.com/docs/cloud-messaging/customize-messages/set-message-type

Notification history is purely local to the device. It is not sent to any servers.

Good? No.

I think it is telling about Signal, though, that despite being in a privacy-unfriendly jurisdiction, federal authorities can only extract data from it when its users mess up.

I don’t think you’ll get much better until some of these other services mature more. Some of them seem painted into a corner where improving them further seems to involve rewriting big sections of them, like Matrix, so I am less optimistic about those.

There’s Matrix which is selfhostable but “good” is pushing it and the cryptography is a bit iffy (probably more incompetence than malice). Though selfhosting it means you don’t need the end to end encryption quite as much… until the court gets involved of course.

– Frost

As of now the most complete alternative (albeit controversial) is the decentralised SimpleX Chat. But it’s not as easy to use as Signal.