WhyJiffie comments on Signal messages retrieved from iOS notification, as seen in Prairieland federal trial

Signal messages retrieved from iOS notification, as seen in Prairieland federal trial (europe.pub)

submitted 6 months ago by frocalannifo@fedia.io to c/technology@lemmy.world

84 comments fedilink hide all child comments

TLDR: signal content in Apple notification can be retrieved even after signal app deletion.

I saw from this reddit thread: Signal messages retrieved from iPhone after uninstalling app. : signal

Referencing this news article: Pretti Killing May Affect ICE Prairieland "Antifa Cell" Terrorism Trial

The mention of signal is in court documents here: March 10: Federal Trial Day 12 - Support the Prairieland Defendants

Signal chat evidence from Sharp’s device (Exhibit 158):
Messages were recovered from Sharp’s phone through Apple’s internal notification storage — Signal had been removed, but incoming notifications were preserved in internal memory. Only incoming messages were captured (no outgoing).

[–] WhyJiffie@sh.itjust.works 4 points 6 months ago (5 children)

It's not because of push notifications. the message is not sent to firebase, just a signal that the app should do a refresh.

It's because the system saves the notifications apps posted to the notification menu.

permalink

fedilink

source

parent

hideshow 5 child comments

[–] Bazoogle@lemmy.world 1 point 6 months ago (4 children)

It’s not because of push notifications. the message is not sent to firebase, just a signal that the app should do a refresh.

Is is 100% because of firebase. Here is an example payload from firebases official document:

{
  "message":{
    "token":"bk3RNwTe3H0:CI2k_HHwgIpoDKCIZvvDMExUdFQ3P1...",
    "notification":{
      "title":"Portugal vs. Denmark",
      "body":"great match!"
    }
  }
}

https://firebase.google.com/docs/cloud-messaging/customize-messages/set-message-type

Notification history is purely local to the device. It is not sent to any servers.

permalink

fedilink

source

parent

hideshow 4 child comments

[–] olorin99@kbin.earth 4 points 6 months ago

Notification history is purely local to the device. It is not sent to any servers.

Yes the notifications were retrieved from the phones local storage. Firebase was not involved in anyway.

permalink

fedilink

source

parent

[–] WhyJiffie@sh.itjust.works 3 points 6 months ago* (2 children)

that is the documentation of firebase, not signal. firebase just shows a common example there that is easy to implement for beginners and lazy devs. but developers can send whatever they want through firebase. I wouldn't be surprised if that's what facebook messenger is doing, but if a developer cares about their users privacy, they can just send a simple message through firebase, and make the app so that when receiving that, it checks for new messages by itself.

this is what the molly fork does with unifiedpush. the UP server, commonly ntfy.sh, only sees that the mollysocket server sent this to your molly client:

{"urgent": true}

Notification history is purely local to the device. It is not sent to any servers.

I did not claim so. but when your phone is confiscated, it's possible to read that out

permalink

fedilink

source

parent

hideshow 2 child comments

[–] 0_o7@lemmy.dbzer0.com 0 points 6 months ago (1 child)

Why are you using an example molly client using unified push on a post about Signal?

Signal isn't molly and cannot unified push at all.

Can you point to signal source code with this implementation?

permalink

fedilink

source

parent

hideshow 1 child comment

[–] WhyJiffie@sh.itjust.works 1 point 6 months ago

good question, and I was wrong.

as of this latest commit, push notifications are represented by PushNotification types. the notification message is the 4th parameter in the constructor.

this kind of object is created in PushNotificationManager and PushNotificationScheduler.
out of 6 functions that send a notification, 1 actually sends notifications of messages, and it omits putting in the message part: https://github.com/signalapp/Signal-Server/blob/75948dc6174ed091180aa20c018fa0f353130ee0/service/src/main/java/org/whispersystems/textsecuregcm/push/PushNotificationManager.java#L49

so the signal server does not send {"urgent": true} to firebase, it sends no message, just kind of a ping in my understanding.

permalink

fedilink

source

parent