iOS stores the previously displayed notifications in an internal database, which was used to access the data. It’s outside of Signal’s control, they recommend disabling showing notification content in their settings to prevent this attack vector

▲

exitb 7 hours ago | parent [-]

They do control the content on the notification. It's a bit odd to put the sensitive text in the notification only to recommend disabling it at the system level.

▲

kccqzy 7 hours ago | parent | next [-]

No. They recommended disabling it at the app level. Only the Signal app can control whether the message contents are included in the notifications.

▲

frizlab 7 hours ago | parent | prev [-]

They do not. They send encrypted notifications. It’s the OS that stores them unencrypted. It’s the OS at fault here IMHO.

▲

throawayonthe 7 hours ago | parent [-]

i think they're replying to the "recommendation" part -- if it was recommended, why isn't it the safe default?

i haven't actually seen signal or anyone adjacent recommend that previously though, idk where that claim came from

	▲	shantara 4 hours ago \| parent [-]
		Sorry, the “recommended” was a bad wording on my part. The recommendation comes from the 404 Media article who did the expose on this incident, not Signal itself. I’ve checked the Signal documentation page, and there’s no mention of the privacy implications of the setting: https://support.signal.org/hc/en-us/articles/360043273491-In...