"Apps like Signal" is an exaggeration. Practically all programs do that. This has always been about metadata.

If the entire push is "you have a new message", then the only metadata in the push is the timestamp, who it's pushed to, and what app it's for, right?

Like a poster in a previous thread say, the "only" in "only metadata" is outright malicious. It's more than enough.

More than enough for what? To find out what someone is saying on Signal? I don't think so.

It’s not a full workaround. You can still see that a message arrived and when.

…so? That’s just not very useful when applied to a large scale service like Signal. You and god knows how many other people are getting a generic “check me” notification at a high rate.

I can imagine it could be useful, e.g. if you already have metadata on “dates when user A messaged user B”, and are trying to de-anonymize user B.

Again, this doesn't necessarily apply in the case of a sufficiently used service like Signal:

- Alice sends message to Bob at 12:01PM - Bob receives generic "check me" notification at 12:02PM

The key point with line #2 is that Bob is not the only user at 12:02PM who received that generic notification, and is likely in more chat than one. Pinning the specific notification to Bob is a needle in a haystack. It's not perfect, but it's not the slam dunk people are making it out to be.

And before that's even a concept, you have to contend with the fact that it's very hard to use an Apple device anonymously. The government doesn't need to correlate message timings, because if they have the APNS token for the device, all they have to do is ask Apple who the hell owns the device.

Anonymity and privacy are two different, albeit related, concepts.

If you have metadata for a couple of messages it is no longer a needle. Not sure what your point about APNS tokens is - I agree, once they hone in on who received the messages Apple would know the device.

Correlations in the timings of notifications can unlock members of group chats by IP or even Apple ID.

And a lot of messaging programs send push notifications for highly dubious reasons, like when you read your own messages (so that the other devices mute their notifications). Element does this.