this post was submitted on 09 Dec 2023
554 points (93.4% liked)
Technology
59135 readers
6622 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
https://www.macrumors.com/2023/12/06/apple-governments-surveil-push-notifications/
The US government is forcing Google and Apple to share push notification data with them. Even if the content is not sent, the metadata alone can let them know who you are talking to and when using metadata correlation.
Signal push notifications don’t contain any useful plain text data (no content, no information about who sent you a message). AFAIK the only thing you would be leaking is that you received a message on signal, and frankly that metadata is probably going to be leaked to the US government regardless of your use of push notifications.
How?
Because your ISP and cell phone provider can tell you’re connecting to signal.
They can tell you connect to AWS when the Signal app fetches messages after a notification, they need to be able to peek into Amazon's servers to see you're connecting specifically to Signal
AWS is not a black box from the outside. The signal servers will have their own external IP addresses that you will connect with, your ISP could keep track of those connections. Furthermore, if you are worried that the government is using your ISP to spy, what makes you think that AWS wouldn’t be subject to that as well? Signal is absolutely a target in this respect too.
Of course you can do various things to potentially hide your connection to signal, for instance by using tor, but in some sense there’s no guarantee if you don’t trust anything external to you. I’m personally not too worried about the “this person uses signal” metadata, though.
it's not the content in the noti, it's where your phone was connected when it received it
They get that from the carrier already
I mean… if you need to be worried about that, you really shouldn’t have a phone on you.