New from 404 Media: the FBI was able to extract incoming Signal messages from a phone even though the app was deleted.

[stevebellovin@infosec.exchange]

@josephcox As I've long said, "you don't go through strong security, you go around it."

[misusecase@twit.social]

@josephcox There has been some concern about security vulnerabilities and leaks associated with iOS notifications for a while, right?

[ujay68@mastodon.world]

@josephcox Can we be more specific here? I can’t imagine technically that there’s a possibility of messages arriving *after* deleting the app being decrypted and stored in a device’s notification database? So this is probably about messages that arrived *before* deleting the app?

[lasagne@chaos.social]

@arrakeen_urbanite @josephcox

If these fucking blogs would not just repost and instead provide advice...
Like maybe testing how to clear that buffer.

[netraven@hear-me.social]

@ujay68 @josephcox I just read the text and it seems pretty clear that it was saved in the notification databse. so....not the app. Does that help?

[pee@mastodon.online]

@josephcox

this is an old problem and as far as I remember, does not only affect iOS but all platforms incl. Android, Windows etc.

Therefore it's a good idea to disable 'preview' in all notifications for all Apps on all platforms - as far as I recall, these are already mass-intercepted in transit.

What's new to me is that iOS stores these, even after having deleted an App - begs the question, what about other platforms?

[jdoe@freeradical.zone]

@lasagne @arrakeen_urbanite @josephcox Just yet another click baity headline from 404 media, nothing new.

[peteorrall@mastodon.bsd.cafe]

@josephcox While obviously concerning, my first thought is if someone needs to securely communicate then perhaps a smartphone with an OS you can't fully control isn't the best tool.

Signal may have great encryption but if the host OS has known vulnerabilities or design flaws that allow for this, then what's the point?

I am certainly open to suggestions and discussion for better solutions.

[elly@donotsta.re]

@josephcox I thought it was obvious? Anyone who ever looked at iOS or Android logs knows that every single notification you ever received is stored in the system logs, which are transferred to new devices if you use migration assistant or encrypted backup.

It's a valid and big attack vector, that's why I personally have notifications enabled to just tell me which app it is and why i'm getting a notification, no other context. Especially since push notifications are handled by Google/Apple's servers so if you can MITM it, you can collect a lot of sensitive data.

[ujay68@mastodon.world]

@Netraven I guess so. Wondering if iOS offers an API that Signal could (have) use(d) to completely clear its notifications from that db. I guess not so.

[netraven@hear-me.social]

@ujay68 I don't know, sorry.

[drwho@masto.hackers.town]

@SteveBellovin @josephcox Can I quote you on that?

[stevebellovin@infosec.exchange]

@drwho @josephcox Sure.

[drwho@masto.hackers.town]

@SteveBellovin @josephcox Thank you kindly.