So the vulnerability here was the iphone, not the app.
post
Why are old notifications saved at all?
And if they are saved, why can't I look at them?
you just need to turn off message previews in notifications then… and disable siri
Doubt doing that has any effect on the database, it just hides the preview on a locked phone.
doubt you have any idea how any of this works and just default to “all electronics are bad”!
even though you’re using a phone right now.
….
just lazy
doubt you have any idea how any of this works
Do you know how Apple manages their databases? Do they use MySQL or Postgres?
I’m sure whatever they use doesn’t negate that a toggle switch is a simple 1 changing to a 0 and vice versa.
if you disable message previews in the app, those messages are never decrypted and put into the notification stack, and can’t be backed up in icloud. Which should also be disabled.
the security implications of turning on messages previews is pretty obvious, and they are also mentioned in the app.
if you have message previews popping up on your lock screen of your terrorism plans, then you’re a fucking idiot.
if you glamourize the massacre at waco texas, then you’re a fucking idiot (they really did).
if you spend months planning a bombing and ZERO minutes planning opsec, then you’re a fucking idiot.
either this whole thing is a fake terror plot manufactured by the government, or they’re fucking idiots… or maybe a nifty combination.
Signal messenger provides bulletproof end to end encryption, but all pipes leak at both ends.
FUD, btw.
enabling message previews was always a security vulnerability with signal.
letting iCloud back up your phone is a security vulnerability… signal can only control what goes on in their app, they could never control the rest of the phone.
….
have you read anything about this case? they were _ complete idiots_ cosplaying as revolutionaries, planning on making a bomb and becoming terrorists.
They were idiots with terrible opsec, and probably would’ve never gone further than talking shit and making one pipe bomb in the desert.
you can either learn from their lack of OpSec, or just scream fud and all electronics are bad, and sit alone writing on paper and refusing to use the internet, just like they want you to do.
Anyone know if this retained on android notifications ?
Signal already has a setting that blocks message content from displaying in push notifications; the case highlights why such a feature might be important for some users to turn on.
Why would any phone / desktop keep notification history? I already don't get the notification feature in default KDE Plasma desktop.
Sometimes I try to swipe up and the phone interprets it as a sideways swipe and dismisses something I hadn't read. So I've hit the history feature to see what that might have been.
Now, what I'd prefer is an undo button, and I wouldn't have expected that history to persist more than 10 minutes, but it's not 100% useless.
Dunst has one by default. I have used it twice. Once when I was very tired and couldn't output something into a file for some reason (I think it was a full disk) and piped it into a notification instead and once when a program put some error message in there and the notification expired before I read it.
It can also be fun for seeing how your perception of notifications compares to the ones that actually show up. It is however important to remember that it exists and to not let important data end up there.
If you accidentally dismiss a notification, you can go back in the history to see it. Or if you dismiss a message notification that you want to respond to later. Or if a notification keeps popping up and disappearing and you want to investigate.
Fair enough. But I don't think more than 24h of notification history would ever be needed, right ?
Because it's extremely useful? I had a shitfit when I bought an iPhone and then realized if I accidentally dismissed a message it was just erased from existence.
The real question is why Apple isn't doing cleanup of their logs. There's no reason to maintain that information after a notification has been acknowledged.
We're going to need phone cases that require a password, and destroy the phone if tampered with. And a signal blocking bag for occasions.
It's great to know that there has been a "notification db" storing a history this entire time, yet users have no way of viewing a notification the moment it is interacted with in any way, even accidentally... You're just renting apples computer, so fuck you, I guess?
Meanwhile, Linux people are flipping out over having to tell their os they are >18.
Am...I don't have to?
also no other Linux user has to do either
Just because one systemd dev prepared something to be optionally used for a stupid law, doesn't mean anyone using Linux is forced to do that
Seems you don't know how anything on Linux, and it's ecosystem, works, if you believe that
And the relation to that news is also a mystery to me
Seems you don’t know how anything on Linux
What makes you think that is what they think? They referenced other people. They didn't make any claims themselves or made any indications that they agree with those "flipping out" (who misunderstand).
I read it as the opposite. They know and criticize those who don't and flip out because of that.
Just because one systemd dev prepared something to be optionally used for a stupid law, doesn't mean anyone using Linux is forced to do that Seems you don't know how anything on Linux, and it's ecosystem, works, if you believe that
This is disingenuous at best.
Sure, its 'just' a single text field that 'optionally' can be used. until it isn't.
SystemD itself is a perfect example of this. Sure you have choice in theory, but in practice its a wildly different story. Name one mainstream Linux distro that can be used for casual day to day use, ranging from doing taxes to playing Steam games that does not use SystemD.
A lot of people drew issue with SystemD when it came out and as time progressed, but the number of fully supported core distros that do not use SystemD is zero.
Nobody's concerns were considered, and not one uses Runit, InitRC, or even just refused to move on from SysVInit, unless you count Gentoo. Debian is SystemD. Arch is SystemD. Fedora is SystemD. And so are almost all their derivatives.
In order to get away from SystemD, you have to switch to forks that intentionally go out of their way to make it happen like Artix. Arch's wiki page literally tells you that you can have any init system as long as it's SystemD.
You are left to rewrite entire core system components yourself and maintain them if you really want to make it happen.
So yea, you technically have a choice, but not really.
Try out GuixSD, it got herd. It works great!
SystemD is not just init. There are no hard rules to use all of it, btw. Not to mention that if you have a field left to control users age, no one is stopping them to write the value 30 and have full access for the system...
What's with the all or nothing approach, tho?
So the fix for that should be not to let your phone's unencrypted notification database have access to the content of your encrypted messages.

I guess notifications being constantly broken in Beeper (app I use for Messenger and Signal) are a good thing now.
all 20 comments