News for hackers. Stuff that matters.

A comment on Grand jury subpoena for Signal user data, Central District of California. Parent comment

Re:Grand jury subpoena for Signal user data, Central Distric... by akouri on Friday October 29, 2021 @04:00PM (#29042908)
When you craft a push notification server-side, it contains the payload in plaintext. Now, that is probably encrypted in Apple-land, but my point is that the gov't probably has sunk its teeth into Apple already. So, yea signal's encryption may be open source and proven, but I doubt Apple's doesn't have a backdoor.
[ Parent | on HN ]
Re:Grand jury subpoena for Signal user data, Central Distric... by ylk on Friday October 29, 2021 @04:08PM (#29043003)
I mean Apple themselves is telling devs to not send sensitive data in the actual notification

> [...] never include sensitive data or data that can be retrieved by other means in your payload. Instead, use notifications to alert the user to new information or as a signal that your app has data waiting for it.

https://developer.apple.com/library/archive/documentation/Ne...

[ Parent | on HN ]
Re:Grand jury subpoena for Signal user data, Central Distric... by egberts1 on Friday October 29, 2021 @06:06PM (#29044063)
that’s why Signal sends an empty notification then uses their own EE2E for notification wordings.
[ Parent | on HN ]
Re:Grand jury subpoena for Signal user data, Central Distric... by MrKristopher on Friday October 29, 2021 @04:05PM (#29042971)
Not sure if Signal is doing this, but they could send a notification with title "New message" and encrypted payload. The payload can be processed by a client-side notification extension which decrypts the payload and chooses what notification text the user will see.
[ Parent | on HN ]
Re:Grand jury subpoena for Signal user data, Central Distric... by diebeforei485 on Friday October 29, 2021 @10:46PM (#29045574)
Not true. The server can send encrypted (not plaintext) payload. The client can then use a NotificationExtension to decrypt the payload as it comes in.

https://developer.apple.com/documentation/usernotifications/...

[ Parent | on HN ]