Technology

Signal has supported this for many years. Users can choose full content notifications, name only, or no-content notifications.

That's not the problem here. Showing a notification with content is not a big deal.

In the case stated here, the big deal is that the notification HISTORY was preserved after removal of Signal. That's because both Apple and Google do the same thing. They keep a notification history. Not on a per-app basis, ALL apps notification history is stored.

I know that on Androids, it is turned off by default and you can turn it on, so you get the impression that Android doesn't have this issue. I am going to guess as I do not own an apple anything that iOS has notification history turned on by default. This is the real problem. This is not anything Signal can control for unless they were to not support notifications which would render their app useless, so that's not an option.

and on some level it's important for good opsec that things that don't require opsec be done with good opsec

I imagine that the signal devs viewed it as a similar concern as when you mistype your password the error message doesn’t give you any way to know if the password is wrong or if the account doesn’t exist.

If only some of your notifications are sanitized then those are the suspicious ones. If all of your notifications are sanitized then none of them are suspicious. Or, at least, they’re all equally suspicious, opaque, and unidentifiable.

You most certainly do. I looked in my notification history in my founding of signal messages.

Then I turned off my notification history.

as far as i know signal uses Google's notification service and if you want it to not you need to use Molly

Signal on Android does not use Google's push notification service

Source? I'm pretty sure it falls back to a different mechanism when it doesn't find google services. And that is only on the version downloaded from their website.

https://github.com/signalapp/Signal-Android/issues/13290

It's not about how it's pushed. It's how it's displayed (and stored) on the phone.

there's a lot of things under fascism that shouldn't be needed

I think on android, signal do not use Google's push notification. They simple send a dummy push, and the signal app wakes up to retrive the latest message directly from signal server.

So Google never have your notification content. I am not sure if they do the same on iOS.

That being said if your attack model includes people reading your notification lock screen, then you should disable showing signal notification.

Good? No.

I think it is telling about Signal, though, that despite being in a privacy-unfriendly jurisdiction, federal authorities can only extract data from it when its users mess up.

I don't think you'll get much better until some of these other services mature more. Some of them seem painted into a corner where improving them further seems to involve rewriting big sections of them, like Matrix, so I am less optimistic about those.

There's Matrix which is selfhostable but "good" is pushing it and the cryptography is a bit iffy (probably more incompetence than malice). Though selfhosting it means you don't need the end to end encryption quite as much... until the court gets involved of course.

-- Frost

As of now the most complete alternative (albeit controversial) is the decentralised SimpleX Chat. But it's not as easy to use as Signal.

Because it's FAANG