I am a firm believer that there are many privacy techniques you should focus on before encrypted messaging because they will offer you much more “bang for your buck,” things like good passwords, two-factor authentication, and even encrypted email. That said, I still believe that encrypted messaging is a critical part of a well-rounded privacy and security strategy. While the vast majority of our day-to-day conversations may be benign, it can still offer a lot of insight into who we are as people – our routines, likes, and personal thoughts. This information – mundane or not – is worth protecting.
Another basic thing – If your messenger is throwing your messages in a notification; it’s being logged. Google was found to be logging almost all notification content. Make sure your message app isn’t putting the content of messages into notifications.
Now this is why I read comments. You’re absolutely right and I knew this info and just hadn’t put the two together. Thank you. Settings changed.
You can also just use a degoogled os which won’t be logging your notification content. But in any case you shouldn’t have notifications as notifications are exclusive with at-rest encryption (or I guess you could have at-rest encryption but just have the db constantly decrypted whenever your phone is on? Seems to defeat the point then)
Which DeGoogled OS do you know of that uses their own notification backend?
https://www.reuters.com/technology/cybersecurity/governments-spying-apple-google-users-through-push-notifications-us-senator-2023-12-06/
deleted by creator
Presumably any degoogled OS would remove that kind of telemetry—it seems like quite an obvious oversight if they continue to send notification contents to Google’s servers? If the suggestion is that it’s through a backdoor, then that’s the responsibility of the open source community to spot the backdoor in the AOSP.
If the app implements their own notification system and doesn’t rely on GCM then Google isn’t able to log them as far as I know.
Sure – but how many of them actually do?
deleted by creator
But not Signal? I use Signal but I’m not sure I can get my chat groups to use something else.
deleted by creator
I just run it in the background. It pulls almost no battery so it is a non issue.
Also getting it to work with Unified push requires extra effort.
I would do the same but it uses too much battery for me so I had to figure out how to self-host ntfy and mollysocket.
deleted by creator
Signal has a ton of the dependence on proprietary software. You won’t find Signal on F-droid.
Best option is Molly foss
Conversations does not. Its only optionally available for those really shitty phones that otherwise can’t get notifications at all.
Ah, I got it backwards, sorry.
Briar just says x private messages
Element X (Matrix client). Basically anything that offers F-Droid or open source release will have builds without built-in notifications. Play Store/App Store builds requires using native notification systems.
UnifiedPush instead of their own implantation would be better for power consumption ig.
Overall a choice between which Notifier you want to choose would be nice.
Between the apps own notifier and UnifiedPush (also has a Fallback to GCM if wanted)
Molly uses UnifiedPush, so definitely try that. Also, Google may log notifications but they can’t read the messages iirc. Maybe they get some metadata idk.
Unless you don’t have Google or Apple services.
Also I don’t think they log the normal Android notification mechanism. (Not push)
Yeah, if it’s a local notification, they’re not logging that – so far as I’m aware at this point in time.
Do they also log everything that comes through a private ntfy server? Or just what goes through their notifications?
NTFY uses the same mechanic that they do for push notifications; it keeps an open socket and then just communicates across the socket. So they shouldn’t be keeping track of that, so far as I understand the AOSP codebase.
Cool, that’s what I was hoping. I’m perpetually in the “knows enough to be dangerous” category.
Messages can be encrypted
If you put the notification in unencrypted form, across google’s push notification system, it is logged in puretext. I, and everyone else knows, that messages can be encrypted. This was a warning about a very specific thing.
Law enforcement has been doing this to signal users for a while now. The default is to not show the message in a notification, but users keep turning it on, and it uses Google’s notification servers. So law enforcement, got access to people’s signal messages, by going through Google to get the notification history/logs.
The push notifications can be encrypted. Threema encrypts them, for one.
That’s if they use Google’s push notification backend on firebase. FOSS apps from F-droid usually don’t.
Tl;Dr install F-droid damnit
Or you can uninstall/disable google services and inatall something like ntfy. Molly-UP (signal fork) supports that.
deleted by creator