I just started my de-googling journey recently, and so the mechanics of notifications were still unclear to me, and I found this video super helpful.

It explains how most mobile messaging apps (including privacy-focused ones like Signal) rely on Google and Apple's centralized servers to deliver push notifications, which exposes vast amounts of user metadata.

Here's the YT link, for people who prefer it: https://youtu.be/c3ennD3wKn0

you are viewing a single comment's thread
view the rest of the comments
[–] 27 points 4 months ago (6 children)

This is the reason why I went out of my way to use Molly (a fork of Signal), since it supports delivering the push notifications through a self-hosted server instead. Unfortunately the process is complex: it requires both a method to deliver the notifications to your phone via UnifiedPush (an alternative to Google's push system that generally suffices on its own) and a compatibility service called MollySocket (that bridges Signal's notifications with the UnifiedPush provider). Both typically need a self-hosted server and specific configuration to talk to each other though. And I don't even have any contacts that use Signal anymore, so, well...!

  • source
  • hideshow 6 child comments
  • [–] 4 points 4 months ago (4 children)

    You can use push providers if you trust them. For example mozilla hosts one.

    The MollySocket service also does not need and does not have decryption keys, only keys to request encrypted messages from signal servers. Still not something I would want to run on someone elses server without serious privacy considerations.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 8 points 4 months ago (3 children)

    Yup, that's why I use my own server to host both MollySocket and UnifiedPush (via NTFY).

  • source
  • parent
  • hideshow 3 child comments
  • [–] 2 points 4 months ago (2 children)

    NTFY can provide UnifiedPush? I didn't know that!

  • source
  • parent
  • hideshow 2 child comments