FBI Extracts Suspect’s Deleted Signal Messages Saved in iPhone Notification Database

It always bears repeating, push notifications are not private, neither for Android, GrapheneOS, nor iOS, even if you use end-to-end encryption. If you are privacy conscious, you should either use settings to hide sensitive data from push notifications or turn them off altogether.

I am no Android developer, but can’t the push notification payload be encrypted? firebase.google.com/docs/…/encryption A better question is if Signal does this already.

So it’ll use TLS encryption, meaning that others on your network won’t be able to snoop it, but not end-to-end encryption, so Google/Apple servers will see the plaintext of the push notification content. This is a limitation of the specific implementation of how push notifications work. End-to-end encrypted push notifications would be technically possible but it would require Apple/Google to make it possible. Developers can’t implement it without getting you to run some services yourself, either self-hosted or a long-running background process on your phone, which would be a battery drain. The link you shared isn’t really relevant to push notifications specifically. The best happy medium we can get is to send empty/blank push notifications, which some apps including Signal offer as an option, but you often need to set it that way in the settings. I think Signal does that by default, but very few apps do.

Not true. The push notification for most messengers is a ping with little to no data in it, telling the app to grab messages directly via TLS. That’s how e2e works with push.