| ▲ | saagarjha 4 hours ago | |
If Signal wants to show you a notification with message text, it needs to put it on the screen through an OS service. That service was storing the plaintext on the device. | ||
| ▲ | avianlyric 3 hours ago | parent | next [-] | |
Through an OS service yes, but not a hosted backend service. Obviously that service has store the notification in plaintext (although everything on an iPhone is encrypted at rest, but notification crypto keys have to stay in active memory for the lock screen to work), otherwise it wouldn’t be able to display the notification text. Apple support applications sending encrypted notifications, where the OS launches the app the decrypt the notification body locally and pass it back to the OS for display. | ||
| ▲ | wpm an hour ago | parent | prev | next [-] | |
This is correct, but my understanding of it is that the push notification (which is not the same thing as the actual "Notification" that is shown on the screen) basically contains a "hey $DEVICE, go talk to $APP_NOTO server they got something for you". APNS just taps on the device's metaphorical shoulder and hands them a courtesy phone "call for you sir" | ||
| ▲ | Vinnl 3 hours ago | parent | prev | next [-] | |
Yes, but that service is running locally. | ||
| ▲ | dmitrygr an hour ago | parent | prev [-] | |
> it needs to put it on the screen through an OS service. That service was storing the plaintext on the device. Technically, so can the OS's text drawing primitive while drawing Signal's UI. | ||