<![CDATA[y’all have your #Signal notifications set to “Name Only” or “No Name or Content”, right…?]]>y’all have your notifications set to “Name Only” or “No Name or Content”, right…? 🤔

FBI Extracts Suspect’s Deleted Signal Messages Saved in iPhone Notification Database

“The was able to forensically extract copies of incoming Signal messages from a defendant’s , even after the app was deleted, because copies of the content were saved in the device’s push notification database”

💰 https://www.404media.co/fbi-extracts-suspects-deleted-signal-messages-saved-in-iphone-notification-database-2/

a detailed write-up that’s not paywalled 👇

When deleting Signal is not enough: the FBI, iPhone notifications, and what can reveal

”A few days ago, 404 Media published a detailed report that made a lot of people uncomfortable: the FBI managed to recover Signal messages from a suspect’s iPhone, even though the app had already been uninstalled. No was broken. No Signal server was compromised. The messages were sitting in the phone’s own notification database, waiting to be found.”

Link Preview Image
When deleting Signal is not enough: the FBI, iPhone notifications, and what forensics can reveal

A few days ago, 404 Media published a detailed report that made a lot of people uncomfortable: the FBI managed to recover Signal messages from a suspect’s iPhone, even though the app had already been uninstalled. No encryption was broken. No Signal server was compromised. The messages were sitting in the phone’s own notification database, waiting to be found.

favicon

Andrea Fortuna (andreafortuna.org)


 

]]>https://board.circlewithadot.net/topic/68816811-8b08-445a-aad5-277249cfe632/y-all-have-your-signal-notifications-set-to-name-only-or-no-name-or-content-rightRSS for NodeFri, 15 May 2026 00:21:42 GMTThu, 16 Apr 2026 03:30:02 GMT60<![CDATA[Reply to y’all have your #Signal notifications set to “Name Only” or “No Name or Content”, right…? on Thu, 16 Apr 2026 09:40:34 GMT]]>@david_chisnall @itgrrl @scottymace User story: I explicitly looked for and manually enabled the history on Android bc there were notifs that contained important info but I sometimes removed them from the screen by accident and I couldn't find them in the corresponding app (can't tell the exact app/feature).]]>https://board.circlewithadot.net/post/https://infosec.place/objects/8dab8187-cc00-4b7a-a994-fe4365f478bdhttps://board.circlewithadot.net/post/https://infosec.place/objects/8dab8187-cc00-4b7a-a994-fe4365f478bdThu, 16 Apr 2026 09:40:34 GMT<![CDATA[Reply to y’all have your #Signal notifications set to “Name Only” or “No Name or Content”, right…? on Thu, 16 Apr 2026 09:33:55 GMT]]>@itgrrl @buherator @scottymace

Do you have any idea why they bother persisting more than the notifications currently on the screen? It's weird to collect data that you have no use for. Does it train on-device text-prediction models or something?

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/david_chisnall/statuses/116413696288126102https://board.circlewithadot.net/post/https://infosec.exchange/users/david_chisnall/statuses/116413696288126102Thu, 16 Apr 2026 09:33:55 GMT<![CDATA[Reply to y’all have your #Signal notifications set to “Name Only” or “No Name or Content”, right…? on Thu, 16 Apr 2026 09:02:49 GMT]]>@david_chisnall @scottymace I’ve updated my toot to use a more precise descriptor

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/itgrrl/statuses/116413573987445264https://board.circlewithadot.net/post/https://infosec.exchange/users/itgrrl/statuses/116413573987445264Thu, 16 Apr 2026 09:02:49 GMT<![CDATA[Reply to y’all have your #Signal notifications set to “Name Only” or “No Name or Content”, right…? on Thu, 16 Apr 2026 08:31:30 GMT]]>@buherator @david_chisnall @scottymace AFAIK on iOS there’s no on-device way to search or view the contents any of the internal system databases without jailbreaking (which has become increasingly difficult to do), but there are digital forensics tools (both commercial & open source) that can enumerate them – this is the sort of tool that the FBI used

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/itgrrl/statuses/116413450878373403https://board.circlewithadot.net/post/https://infosec.exchange/users/itgrrl/statuses/116413450878373403Thu, 16 Apr 2026 08:31:30 GMT<![CDATA[Reply to y’all have your #Signal notifications set to “Name Only” or “No Name or Content”, right…? on Thu, 16 Apr 2026 07:31:34 GMT]]>@david_chisnall @itgrrl @scottymace "Is there some way of searching them?" I can only speak of Android: here definitely is a system-level option keep a browsable notification history.]]>https://board.circlewithadot.net/post/https://infosec.place/objects/49de3f97-59bb-4f79-916b-a44bf4ac82bbhttps://board.circlewithadot.net/post/https://infosec.place/objects/49de3f97-59bb-4f79-916b-a44bf4ac82bbThu, 16 Apr 2026 07:31:34 GMT<![CDATA[Reply to y’all have your #Signal notifications set to “Name Only” or “No Name or Content”, right…? on Thu, 16 Apr 2026 07:26:41 GMT]]>@itgrrl @scottymace

Nearly:

it was the amount of detail in the content of push notifications

It wasn’t the information in the push notification. This goes via Apple’s server and is a one-bit signal that says ‘there may be some messages waiting for you, you should go and check’ (may be, because Signal sends some spurious push notifications to make traffic correlations harder).

The Signal app then gets the message and asks the local OS notification mechanism to display the notification. If the permissions are set up to display Signal notifications on the lock screen, these are also persisted in a database on iOS (I have no idea why. Is there some way of searching them?). If you’re worried about people with physical access to your device reading your messages, I would suggest that turning off the thing that shows them on the lock screen is probably a good idea.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/david_chisnall/statuses/116413195967938202https://board.circlewithadot.net/post/https://infosec.exchange/users/david_chisnall/statuses/116413195967938202Thu, 16 Apr 2026 07:26:41 GMT<![CDATA[Reply to y’all have your #Signal notifications set to “Name Only” or “No Name or Content”, right…? on Thu, 16 Apr 2026 04:03:07 GMT]]>@itgrrl Totally agree.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/scottymace/statuses/116412395500015554https://board.circlewithadot.net/post/https://infosec.exchange/users/scottymace/statuses/116412395500015554Thu, 16 Apr 2026 04:03:07 GMT<![CDATA[Reply to y’all have your #Signal notifications set to “Name Only” or “No Name or Content”, right…? on Thu, 16 Apr 2026 04:01:57 GMT]]>@scottymace Signal’s database wasn’t the problem in this instance, it was the amount of detail in the content of push notifications (and it’s persistence) in the iOS ̶A̶P̶N̶ ̶ notifications database

choosing to use a fork like instead of the official client brings its own set of risks and trade-offs to be weighed in the context of your specific threat model

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/itgrrl/statuses/116412390944848183https://board.circlewithadot.net/post/https://infosec.exchange/users/itgrrl/statuses/116412390944848183Thu, 16 Apr 2026 04:01:57 GMT<![CDATA[Reply to y’all have your #Signal notifications set to “Name Only” or “No Name or Content”, right…? on Thu, 16 Apr 2026 03:48:30 GMT]]>@itgrrl Yes, it does have android implications.
1. Open Signal.
2. Tap your profile icon.
3. Tap Notifications.
4. Under Show, select “No name or message”.
If using Molly, users can additionally enable database encryption at rest, which encrypts Signal’s local database with a separate passphrase — adding protection against on-device forensic extraction of the app’s own data.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/scottymace/statuses/116412338076277226https://board.circlewithadot.net/post/https://infosec.exchange/users/scottymace/statuses/116412338076277226Thu, 16 Apr 2026 03:48:30 GMT<![CDATA[Reply to y’all have your #Signal notifications set to “Name Only” or “No Name or Content”, right…? on Thu, 16 Apr 2026 03:42:24 GMT]]>@scottymace I don’t know the details of push notification storage on Android, but limiting the content of push notifications for any privacy-focused apps is a sensible precaution regardless of the app or the platform you use it on (some people run Signal on desktop OSes too)

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/itgrrl/statuses/116412314084252076https://board.circlewithadot.net/post/https://infosec.exchange/users/itgrrl/statuses/116412314084252076Thu, 16 Apr 2026 03:42:24 GMT<![CDATA[Reply to y’all have your #Signal notifications set to “Name Only” or “No Name or Content”, right…? on Thu, 16 Apr 2026 03:38:21 GMT]]>@itgrrl I see no mention of the implications for Android devices. Does the same issue exist?

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/scottymace/statuses/116412298103774141https://board.circlewithadot.net/post/https://infosec.exchange/users/scottymace/statuses/116412298103774141Thu, 16 Apr 2026 03:38:21 GMT