FBI Extracts Suspect’s Deleted Signal Messages Saved in iPhone Notification Database
2026-04-09 15:08 UTC
Replies (21)
-
@absGeekNZ@lemmy.nz 2026-04-09 18:39
Notification history is off by default in GrapheneOS…so that is nice.
-
@percent@infosec.pub 2026-04-10 02:07
iPhones save old notifications in a database? Why?
-
@bearboiblake@pawb.social 2026-04-09 15:28
It always bears repeating, push notifications are not private, neither for Android, GrapheneOS, nor iOS, even if you use end-to-end encryption. If you are privacy conscious, you should either use settings to hide sensitive data from push notifications or turn them off altogether.
-
@dudesss@lemmy.ca 2026-04-10 00:36
Use Molly as your Signal client instead. It solves this.
-
@NotMyOldRedditName@lemmy.world 2026-04-09 16:36
What's the purpose of keeping a history of seen notifications in a database? That shit should be being automatically purged if it needs to exist to show it, after its been dismissed. I wonder if this revelation will trigger a change in how it works, since apple has often tried to do things securely?
-
@cecilkorik@piefed.ca 2026-04-09 20:55
End-to-end encryption is the final boss of false-sense-of-security. Like, it's great and all, but it's not universal perfect privacy the way a lot of people seem to hold it up as if it were. You have to understand what it's actually defending against, and who might be blocked by that, and more importantly, who won't be. Because the list of potential adversaries it is actually useful against are becoming narrower and increasingly out-of-date. Encryption alone prevents the messages being read in transit between you and Signal, and obviously that's fundamental basic security at this point. Signal being end-to-end encrypted prevents your messages being spied on by Signal, but ironically they're probably one of the most trustworthy actors in this whole chain, so the fact that it's protected *from them*, while commendable, is not particularly *valuable* security. They were probably not the ones going to spy on you in the first place. They have prevented themselves from being capable of doing so, and that's good, but if that's all you're worried about and you now think your privacy problems are solved, you're completely missing the point because instead of Signal themselves, you need to be worried about the guy currently standing over your shoulder with his camera filming. Treat your phone and your Windows computer like they are permanently compromised with a rootkit taking continuous screenshots of everything you do and feeding that to their big tech overlords, because they might as well be. For that matter, even Linux PCs still have their black box "intel management engine" or similar processor running constantly and potentially watching everything you do, although I don't believe they actually do that in any reasonable case, we need to understand they have both the capability and the motivation to be, at least in some cases, compromised by adversaries which may include (but are not limited to) tech companies and governments. You can't even trust your "dumb monitor" unless you've audited every chip inside it, you'll never know if it could be scanning everything on your screen and feeding it back through HDMI/DP back-channels or even through powerline networking. You also don't know if the same kind of things could be happening on the other side that you're sending/receiving from. Sure the network trip is protected, but that's hardly the only place you're vulnerable to interception. That probably all sounds paranoid and extreme and improbable, and it is, but the point is end-to-end encryption does nothing to help you against any of that, so don't make the mistake of assuming you're 100% safe because it's end-to-end encrypted. The "end" is not what you think it is and it's not paranoid to at least understand that and accept the risk with the understanding. I realize I am probably preaching to the choir here, and most of you probably understand this as well as I do. But I'm also pretty sure a lot of people truly believe it's more secure against eavesdropping than it actually is and that needs to change. The surveillance state is adapting and expanding rapidly and I fear they've started getting ahead of many of us. Beware, and plan carefully in the months and years ahead.
-
@AzuraTheSpellkissed@lemmy.blahaj.zone 2026-04-09 15:28
That's a interesting approach. It kind of backdoors a lot of private communication efforts. I can't even be sure, if disabling notifications for signal would avoid them from showing up in the database anyways
-
@eager_eagle@lemmy.world 2026-04-09 21:08
my signal notification history is a lot of "Locked message"
-
@Jalfred_prurock@lemmy.today 2026-04-09 22:12
What if your notifications are turned off? Is anything stored in that circumstance?
-
@homesweethomeMrL@lemmy.world 2026-04-09 16:22
Not allowing notifications has been SOP since the beginning. Go through your settings. There’s almost certainly some app doing something you don’t prefer.
-
@tirateimas@lemmy.pt 2026-04-09 17:20
doesn't signal use empty notifications by default?
-
@homes@piefed.world 2026-04-09 16:57
yeah, my first reaction was, "hmmm, clever..."
-
@evasive_chimpanzee@lemmy.world 2026-04-09 15:32
I'm assuming that changes what it actually displays, but is there confirmation that those data dont enter the notification system on the back end?
-
@Chozo@fedia.io 2026-04-09 15:27
I imagine a similar exploit will work on Android devices, as well. Wouldn't have considered it, but it may be a good idea to figure out how to disable the content from appearing in the Android notifs, too.
-
@Cherry@piefed.social 2026-04-09 16:24
Thanks for taking the time to post a helpful instruction.
-
@homes@piefed.world 2026-04-09 16:58
glad to know this setting is available
-
@frongt@lemmy.zip 2026-04-09 18:16
I have it turned on. It only shows the last 24 hours.
-
@yessikg@fedia.io 2026-04-10 02:23
I just checked and it seems to be off by default in e OS, another W
-
@just_another_person@lemmy.world 2026-04-09 15:17
Clever. Not much you can do for this except not subscribe your app to the notifications API, or take extra steps to attempt to clear them, but I don't remember that being an option on iOS. Going to be an interesting fix.
-
@CuddlesMcBubblefun@lemmy.world 2026-04-09 20:56
You know, I'm starting to think that maybe the "drive bay full of thermite" guy way back in the day WASN'T crazy...
-
@RabbitBBQ@lemmy.world 2026-04-09 22:02
Any software allowed on an appstore can be backdoored and decrypted many different ways. Even if the notification routing was turned off to prevent this, you still have a virtual keyboard that can be debugged at the system level or in one of the secure enclaves running on an iPhone. All of it is an illusion of security being sold for profit. Even the devices allowed to be sold must be backdoored many differnet ways by the state. In other words, anything that actually provided security and anonymity either from a hardware or software level would never be allowed on the market in the first place.