I am a firm believer that there are many privacy techniques you should focus on before encrypted messaging because they will offer you much more “bang for your buck,” things like good passwords, two-factor authentication, and even encrypted email. That said, I still believe that encrypted messaging is a critical part of a well-rounded privacy and security strategy. While the vast majority of our day-to-day conversations may be benign, it can still offer a lot of insight into who we are as people – our routines, likes, and personal thoughts. This information – mundane or not – is worth protecting.
Another basic thing – If your messenger is throwing your messages in a notification; it’s being logged. Google was found to be logging almost all notification content. Make sure your message app isn’t putting the content of messages into notifications.
If the app implements their own notification system and doesn’t rely on GCM then Google isn’t able to log them as far as I know.
UnifiedPush instead of their own implantation would be better for power consumption ig.
Overall a choice between which Notifier you want to choose would be nice.
Between the apps own notifier and UnifiedPush (also has a Fallback to GCM if wanted)
Sure – but how many of them actually do?
I can throw a few examples:
So, the answer is — almost every of them.
Element X (Matrix client). Basically anything that offers F-Droid or open source release will have builds without built-in notifications. Play Store/App Store builds requires using native notification systems.
Briar just says x private messages
But not Signal? I use Signal but I’m not sure I can get my chat groups to use something else.
Signal has a ton of the dependence on proprietary software. You won’t find Signal on F-droid.
Best option is Molly foss
I mentioned Molly — Signal fork. It can show notifications via UnifiedPush or websocket.
I just run it in the background. It pulls almost no battery so it is a non issue.
Also getting it to work with Unified push requires extra effort.
Yeah, configuring a mollysocket requires at least a little self-hosting knowledge.
I would do the same but it uses too much battery for me so I had to figure out how to self-host ntfy and mollysocket.
Conversations does not. Its only optionally available for those really shitty phones that otherwise can’t get notifications at all.
Ah, I got it backwards, sorry.
Now this is why I read comments. You’re absolutely right and I knew this info and just hadn’t put the two together. Thank you. Settings changed.
That’s if they use Google’s push notification backend on firebase. FOSS apps from F-droid usually don’t.
Tl;Dr install F-droid damnit
Unless you don’t have Google or Apple services.
Also I don’t think they log the normal Android notification mechanism. (Not push)
Yeah, if it’s a local notification, they’re not logging that – so far as I’m aware at this point in time.
Molly uses UnifiedPush, so definitely try that. Also, Google may log notifications but they can’t read the messages iirc. Maybe they get some metadata idk.
deleted by creator
Messages can be encrypted
If you put the notification in unencrypted form, across google’s push notification system, it is logged in puretext. I, and everyone else knows, that messages can be encrypted. This was a warning about a very specific thing.
Law enforcement has been doing this to signal users for a while now. The default is to not show the message in a notification, but users keep turning it on, and it uses Google’s notification servers. So law enforcement, got access to people’s signal messages, by going through Google to get the notification history/logs.
The push notifications can be encrypted. Threema encrypts them, for one.
You can also just use a degoogled os which won’t be logging your notification content. But in any case you shouldn’t have notifications as notifications are exclusive with at-rest encryption (or I guess you could have at-rest encryption but just have the db constantly decrypted whenever your phone is on? Seems to defeat the point then)
Which DeGoogled OS do you know of that uses their own notification backend?
https://www.reuters.com/technology/cybersecurity/governments-spying-apple-google-users-through-push-notifications-us-senator-2023-12-06/
You don’t need one. Just use any degoogled ROM with UnifindPush, as almost every secure messenger support it. If not, notifications can still show up via websocket.
Presumably any degoogled OS would remove that kind of telemetry—it seems like quite an obvious oversight if they continue to send notification contents to Google’s servers? If the suggestion is that it’s through a backdoor, then that’s the responsibility of the open source community to spot the backdoor in the AOSP.
Or you can use uninstall/disable google services and inatall something like ntfy. Molly-UP (signal fork) supports that.
Do they also log everything that comes through a private ntfy server? Or just what goes through their notifications?
NTFY uses the same mechanic that they do for push notifications; it keeps an open socket and then just communicates across the socket. So they shouldn’t be keeping track of that, so far as I understand the AOSP codebase.
Cool, that’s what I was hoping. I’m perpetually in the “knows enough to be dangerous” category.