Remix.run Logo
chasil 9 hours ago

First, a critical setting for Signal users:

"Signal’s settings include an option that prevents the actual message content from being previewed in notifications. However, it appears the defendant did not have that setting enabled, which, in turn, seemingly allowed the system to store the content in the database."

Second, how can I see this notification history?

alin23 8 hours ago | parent | next [-]

Not sure if it's exactly the same, but I had to add a When notification arrives with <message>, do <action> event trigger in my Crank macOS app (https://lowtechguys.com/crank) so I can show you how to do it on macOS:

      HOURS=6
      EPOCH_DIFF=978307200
      SINCE=$(echo "$(date +%s) - $EPOCH_DIFF - $HOURS * 3600" | bc)

      sqlite3 ~/Library/Group\ Containers/group.com.apple.usernoted/db2/db \
        "SELECT r.delivered_date, COALESCE(a.identifier, 'unknown'), hex(r.data)
        FROM record r
        LEFT JOIN app a ON r.app_id = a.app_id
        WHERE r.delivered_date > $SINCE
        ORDER BY r.delivered_date ASC;" \
      | while IFS='|' read -r cfdate bundle hexdata; do
          date -r $(echo "$cfdate + $EPOCH_DIFF" | bc | cut -d. -f1) '+%Y-%m-%d %H:%M:%S'
          echo "  app: $bundle"
          echo "$hexdata" | xxd -r -p > /tmp/notif.plist
          plutil -p /tmp/notif.plist 2>/dev/null \
            | grep -E '"(titl|title|subt|subtitle|body|message)"' \
            | sed 's/^  */  /'
          echo "---"
      done
Basically, notifications are in an sqlite db at ~/Library/Group Containers/group.com.apple.usernoted/db2/db and are stored as plist blobs.

In recent years, filesystem paths for system services have started to converge for both macOS and iOS so I'm thinking with jailbreak you could get read access to that database and get the same data out of it.

627467 8 hours ago | parent | prev | next [-]

On android there are apps that let you see the history - i use NotiStar occasionally to see if i unwittingly dismissed important notifications. And i believe there are apps/settings that help you clear the history from the device.

But this is a reminder that these centralized notification infrastructure (FCM and APNs) store notification content (if the app is told to send content in it - signal with option enabled wouldn't send content) even if we clear local history these middleman still hold it

chasil 8 hours ago | parent [-]

On Lineage Android, i see: Settings / Notifications / Notification History.

If you drop a settings widget on your home screen, it will let you choose a specific area, including notifications.

I don't know if the output is the complete database.

commandersaki 6 hours ago | parent | prev | next [-]

So I wonder about this. The quote from the 404 media article [0] is:

“We learned that specifically on iPhones, if one’s settings in the Signal app allow for message notifications and previews to show up on the lock screen, [then] the iPhone will internally store those notifications/message previews in the internal memory of the device,” a supporter of the defendants who was taking notes during the trial told 404 Media

The default setting appears to be to only show notification preview when unlocked. Will that notification still be stored unencrypted in notification storage or is it in an encrypted store because it will preview after unlock?

It makes sense that any notification that previews on the lock screen would be unencrypted (including the case where it is encrypted but the encryption key is adjacently stored).

This all reads to me that this was a user induced OPSEC issue and Signal had the right defaults.

[0] https://archive.is/bSQhD#selection-619.0-622.0

sillysaurusx 4 hours ago | parent [-]

I think that’s a little nutty. People go to signal for secure messaging. That’s their entire brand. An insecure by default setting is the wrong setting, even if it nets them a lot of tech illiterate users. Compromising the security of the system defeats the entire point of using Signal instead of some other messenger.

By this logic, you, me, and everyone else using the defaults are using bad opsec. Doesn’t that strike you as problematic?

commandersaki 2 hours ago | parent | next [-]

I posted this elsewhere and I said this in my post, but the default setting is actually not the insecure one: https://files.catbox.moe/3gwjoy.png (supposing that previews are stored encrypted when locked which is what the 404media passage implies and nothing to say to the contrary).

This user went out of their way to show previews on the lock screen, that is an OPSEC failure, even if you do not consider the acquisition of the messages digitally.

amazingman 3 hours ago | parent | prev [-]

"Security" is not a binary, but a spectrum along which there are various tradeoffs. The vendor attempts to select the best configuration for its average/median user, and that's almost by definition not going to be the most secure configuration (see: tradeoffs).

I do think there should be some UI somewhere that allows for locking all things down to the most secure configuration possible.

jhalstead 8 hours ago | parent | prev | next [-]

On a Pixel, I can see some history by going to

Android > Settings > Notifications > Manage > Notification History

seb1204 7 hours ago | parent | next [-]

Yes, mine (the history option) is turned off. Nice opt in implementation.

arvid-lind 7 hours ago | parent | prev [-]

Wasn't sure if it was the Pixel or GrapheneOS, but what a relief to actually be covered in one of these weird 0day issues.

Unrelated to the OP, but I bet the thousands of "exploits" that Claude Mythos has identified already are a lot of these kind of things that regular people would never think about.

nashashmi 7 hours ago | parent | prev | next [-]

On android its quite easy. There is a page of a protocol address that has all notifications show. I used to have a shortcut to it. It has been years since I was on android.

But it was really useful each time I did not see a notification in time.

Edit: typo

tsimionescu 7 hours ago | parent [-]

> I used to have a seizure to it.

Hopefully, you meant to write "shortcut"...

nashashmi 6 hours ago | parent [-]

Yes! Thanks.

SwtCyber 4 hours ago | parent | prev | next [-]

You don't, at least not without forensics tools

benhurmarcel 6 hours ago | parent | prev [-]

I wonder how long does the system store those notifications