Let me get this straight...

[beachbum@mastodon.sdf.org]

@avuko @wdormann That’s partly why I’m asking because I disable notifications as soon as I purchase a phone. Locating my phone is important because I misplace it a lot. My location services it’s also always off.
I have a degree in IT, but it goes back to 2006 and so much has changed since then and honestly, I only keep up through what I read here on Mastodon. I thought doing these things would secure my privacy.

[beachbum@mastodon.sdf.org]

@avuko @wdormann I was rather shocked that this could even be possible yet actually occurring.

[prism@infosec.exchange]

@wdormann The default setting is that you get notified when you receive a message, because most people want those.

[craignicol@glasgow.social]

@wdormann @mastodonmigration eh what?

On Android it just shows "you have a new message". Was this an Apple or a Signal decision?

[lennybacon@infosec.exchange]

@wdormann Looks different here. But it’s Most probably the „Preview“ -Thing that causes Information to leak (to the OS which persists it unsecure)

[wdormann@infosec.exchange]

@lennybacon
The screenshot I shared is from the Signal app itself, in Settings.

Not iPhone-wide settings.

[wdormann@infosec.exchange]

@prism
The default setting is that you get notified with the message contents

[wdormann@infosec.exchange]

@tdpsk @Mer__edith
The problem is that such content is not included in unencrypted backups. So we mortals can't even confirm this, as we don't have access to full-device exploit tools such as Cellebrite.

[wdormann@infosec.exchange]

@grammasaurus @omnicore @signalapp

The screenshot I shared is from the Signal app itself, which chooses to include the message content in notifications.

So I'd say that both are at fault.

[thomasareed@infosec.exchange]

@wdormann @Viss It’s been a while since I installed Signal, but I have a vague memory that it may have reminded me to change that setting the first time I ran it.

[wdormann@infosec.exchange]

@CppGuy @avuko

Apple gave governments data on thousands of push notifications

Is open to wide interpretation. Did they give information about thousands of push notifications? (i.e. metadata) (e.g. the App that sent the notification and the timestamp, and potentially account info tied to the request)

If they gave the actual notification content, then that's a whole other scandalous animal. Extraordinary claims require extraordinary evidence, and whatnot.

[lazarus7@infosec.exchange]

@wdormann switching my friends and family to signal was made easier because of settings like this. It behaves like a normal messaging app. None of them have a threat model that has them thinking of device seizure by law enforcement.

[wdormann@infosec.exchange]

@thomasareed @Viss
I don't believe you, as that setting (my screenshot) is within the Signal app itself.

As such, if they wanted a different default value, they would have just released the software with the preferred setting.

[thomasareed@infosec.exchange]

@wdormann @Viss Okay, whatever. “I don’t believe you” is a pretty rude response, as it implies I’m lying and that nothing changed in the years since I installed it. I do distinctly remember some kind of warning about Signal notifications from somewhere, though, so this is most definitely NOT new news.

[lennybacon@infosec.exchange]

@wdormann Thanks. Looks the same in the app to me.

Probably the same but configured from the opposite side of things.

[rolfbly@mastodon.social]

@wdormann @prism

fwiw, I just checked on Android. Notification history goes back only 24 hours. Message + sender visible.

[wdormann@infosec.exchange]

@Mer__edith
On the macOS side of things, we have confirmation that Signal notification contents get stored, even for disappearing messages

iOS sadly offers less visibility into what's going on. But the FBI probably appreciates that it's happening there too.

The default notification setting for Signal (on both iOS and macOS) ensures that potentially sensitive information leaks out of the Signal app. This is unfortunate.

[jason@logoff.website]

@wdormann @Mer__edith it should probably be changed but you also have to weigh this against how many people would try Signal, see that it lacks message previews, and go back to SMS.

[erwinrossen@mas.to]

@craignicol @wdormann @mastodonmigration On my Android it did show Name and message completely. Not sure if I have changed that setting myself in the past 8 years that I have been using Signal, or whether that is/was the default.

[craignicol@glasgow.social]

@erwinrossen @wdormann @mastodonmigration hmm. Entirely possible the default has changed