Settings > Notifications > Show preview

Critical distinction, as merely changing OS notification settings will simply prevent notification content from being displayed on-screen.

Settings > Notifications > Messages > Show

Thank you for adding this to the conversation.

      HOURS=6
      EPOCH_DIFF=978307200
      SINCE=$(echo "$(date +%s) - $EPOCH_DIFF - $HOURS * 3600" | bc)

      sqlite3 ~/Library/Group\ Containers/group.com.apple.usernoted/db2/db \
        "SELECT r.delivered_date, COALESCE(a.identifier, 'unknown'), hex(r.data)
        FROM record r
        LEFT JOIN app a ON r.app_id = a.app_id
        WHERE r.delivered_date > $SINCE
        ORDER BY r.delivered_date ASC;" \
      | while IFS='|' read -r cfdate bundle hexdata; do
          date -r $(echo "$cfdate + $EPOCH_DIFF" | bc | cut -d. -f1) '+%Y-%m-%d %H:%M:%S'
          echo "  app: $bundle"
          echo "$hexdata" | xxd -r -p > /tmp/notif.plist
          plutil -p /tmp/notif.plist 2>/dev/null \
            | grep -E '"(titl|title|subt|subtitle|body|message)"' \
            | sed 's/^  */  /'
          echo "---"
      done

In recent years, filesystem paths for system services have started to converge for both macOS and iOS so I'm thinking with jailbreak you could get read access to that database and get the same data out of it.

The case comes with a long statement about the Antifa “organization”. Just your weekly reminder we are living under an Orwellian administration. https://www.justice.gov/opa/pr/antifa-cell-members-convicted...

Even worse, whatever critical settings you may set as a sophisticated user will frequently be reset, or changed, or re-organized under different settings… And of course, set back to insecure defaults… With subsequent software updates.

This is a regular occurrence with Firefox and privacy settings.

Whatever the actual impetus is, we should act as if this is intentional.

Why does any software keep asking you to do things you explicitly told them you don't want to do? Because it's in the software developer's best interest to get you to do them, not yours. We've gotten way past the point in software where we no longer expect the software to serve the user's interest and solve the user's problems. Now, the expectation is that the user gets nagged and coerced into serving the software's interest and solving the developers' problems.

EDIT: Looks like a developer confirmed this in a sibling comment already: It nags you because that solves their support problem.

But this is a reminder that these centralized notification infrastructure (FCM and APNs) store notification content (if the app is told to send content in it - signal with option enabled wouldn't send content) even if we clear local history these middleman still hold it

“We learned that specifically on iPhones, if one’s settings in the Signal app allow for message notifications and previews to show up on the lock screen, [then] the iPhone will internally store those notifications/message previews in the internal memory of the device,” a supporter of the defendants who was taking notes during the trial told 404 Media

The default setting appears to be to only show notification preview when unlocked. Will that notification still be stored unencrypted in notification storage or is it in an encrypted store because it will preview after unlock?

It makes sense that any notification that previews on the lock screen would be unencrypted (including the case where it is encrypted but the encryption key is adjacently stored).

This all reads to me that this was a user induced OPSEC issue and Signal had the right defaults.

[0] https://archive.is/bSQhD#selection-619.0-622.0

Android > Settings > Notifications > Manage > Notification History

But it was really useful each time I did not see a notification in time.

Edit: typo

If you don't know how to disable it, you use your favorite search engine / LLM / knowledgeable relative to find out, and disable it.

But if you just didn't pay attention, "never thought about it", you don't care about security, and no amount of technical means would help, sorry.

I couldn't believe this so went to look up some data on this.

Holy FUCK that is bleak. There needs to be way more computer education, not just "how2type" classes.

Basically, give you a heads up that the other side has settings that make the system less secure.

Deleting that history is good to know about after the fact, but preferably lets just not create the problem.

But most likely (pure speculation mind you), this was a case of someone handing over the phone for review and where cooperating.

It might have been that they deleted signal some time ago, or even deleted signal and then handed over the phone.

It's notable that the data wasn't recovered from signals storage (was the data securely erased or that kind of recovery not attempted?).

"To use the Signal desktop app, Signal must first be installed on your phone."

If the app generates them, the OS receives them. That's why the Signal app offers this setting.

Normally no notifications are shown for hidden apps, and even if you unhide the apps, prior notifications which were sent do not reappear IIRC. I'm curious if notifications like that are still hitting the phone into the notifications database, or get silently dropped, or something else.

Signal has this setting to tell the backend how much information to put into the push message. It can tell the backend to send a simple notification saying “new message” and not send information through APNS or enable it.

I am willing to bet Signal has a notification extension to handle edge cases where there is lag in settings to scrub the message metadata before it dings a screen alert.

The only one I can think of that doesn't require a mobile login is iMessage, because it's not a chat app, it's lock in and data theft disguised as software

Source? I don't think either OS implements notification syncing between devices, it's only one way, and as others have mentioned, the actually push notification doesn't contain any message content, only an instruction for signal to fetch and decrypt the message.

I also didn't realize that Android stores message history even after I've replied or swiped them away. That's nuts - why!?

And before someone suggests it: If the banner can be removed, you’re back to having lots of complaints for users that did not realise they turned off notifications.

Oh... hmm, two toggles actually. One at Settings > Notifications > Calls > Notifications toggle, and the other at Settings > Notifications > Messages > Notifications toggle

I think we're capable of finding it ourselves if you do.

But it would be nice to have a "don't ask again" option regardless, even if it's hidden in settings.

At some point it is just not beneficial anymore.

iOS does. This is how you can receive Signal notifications on your Apple Watch and other Apple devices that don’t have the app installed.

Can't speak for iOS and no idea if this relates to the above functionality, but Pixel lets you deduplicate notifications across Pixel devices.

I don't see my computers as partners or helpful assistants or eager interns. I see them as tools for reliably performing computation, and I expect them to operate that way.

I fully understand that this means that fewer and fewer developers are "building their software for me" and I find that pretty disappointing.

i haven't actually seen signal or anyone adjacent recommend that previously though, idk where that claim came from

Source: https://mastodon.world@Mer__edith/111563866152334347 (Meredith Whittaker is the current CEO of Signal)

I can't link you rigth now to the actual code on their repo but it is verifiable.

I’ve checked the Signal documentation page, and there’s no mention of the privacy implications of the setting: https://support.signal.org/hc/en-us/articles/360043273491-In...

We as a society have gotten way too comfortable expecting every single person to be available at all times to provide us some kind of immediate response. Let people live. If I'm hiking through the woods with my camera doing bird photography, even if you're my best friend you can wait until I get back to my car and manually check my messages, I don't need a notification. If it's an emergency, dial my number and call me, which will make my phone ring. Novel concept, I know.

The flip side of the coin: any possibly avenue to exfiltrate data and do (advertising) tracking by app developers will be used. The restrictions also protect my privacy.

And my phone battery.