<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"><channel><title><![CDATA[Let me get this straight...]]></title><description><![CDATA[<p>Let me get this straight...</p><p>The <strong>default setting</strong> for Signal on an iPhone allows law enforcement to see the content of all incoming messages, even after the app has been deleted?  <img
      src="https://board.circlewithadot.net/assets/plugins/nodebb-plugin-emoji/emoji/android/1f914.png?v=28325c671da"
      class="not-responsive emoji emoji-android emoji--thinking_face"
      style="height: 23px; width: auto; vertical-align: middle;"
      title="🤔"
      alt="🤔"
    /></p><p><div class="card col-md-9 col-lg-6 position-relative link-preview p-0">



<a href="https://www.404media.co/fbi-extracts-suspects-deleted-signal-messages-saved-in-iphone-notification-database-2/" title="FBI Extracts Suspect’s Deleted Signal Messages Saved in iPhone Notification Database">
<img src="https://storage.ghost.io/c/0f/76/0f76b548-bc58-4f25-abc3-3f5ebca07da4/content/images/size/w1200/2026/04/appshunter-io-BuPiOZN5DOQ-unsplash.jpg" class="card-img-top not-responsive" style="max-height: 15rem;" alt="Link Preview Image" />
</a>



<div class="card-body">
<h5 class="card-title">
<a href="https://www.404media.co/fbi-extracts-suspects-deleted-signal-messages-saved-in-iphone-notification-database-2/">
FBI Extracts Suspect’s Deleted Signal Messages Saved in iPhone Notification Database
</a>
</h5>
<p class="card-text line-clamp-3">The case was the first time authorities charged people for alleged “Antifa” activities after President Trump designated the umbrella term a terrorist organization.</p>
</div>
<a href="https://www.404media.co/fbi-extracts-suspects-deleted-signal-messages-saved-in-iphone-notification-database-2/" class="card-footer text-body-secondary small d-flex gap-2 align-items-center lh-2">



<img src="https://storage.ghost.io/c/0f/76/0f76b548-bc58-4f25-abc3-3f5ebca07da4/content/images/size/w256h256/format/png/2023/08/favicon-3.svg" alt="favicon" class="not-responsive overflow-hiddden" style="max-width: 21px; max-height: 21px;" />



<p class="d-inline-block text-truncate mb-0">404 Media <span class="text-secondary">(www.404media.co)</span></p>
</a>
</div></p>]]></description><link>https://board.circlewithadot.net/topic/ab476368-18ac-4b39-bc8c-010448dce77d/let-me-get-this-straight...</link><generator>RSS for Node</generator><lastBuildDate>Thu, 16 Apr 2026 04:05:11 GMT</lastBuildDate><atom:link href="https://board.circlewithadot.net/topic/ab476368-18ac-4b39-bc8c-010448dce77d.rss" rel="self" type="application/rss+xml"/><pubDate>Thu, 09 Apr 2026 14:56:37 GMT</pubDate><ttl>60</ttl><item><title><![CDATA[Reply to Let me get this straight... on Thu, 09 Apr 2026 17:43:16 GMT]]></title><description><![CDATA[<p><span><a href="/user/wdormann%40infosec.exchange">@<span>wdormann</span></a></span> Looks different here. But it’s Most probably the „Preview“ -Thing that causes Information to leak (to the OS which persists it unsecure)</p>

<div class="row mt-3"><div class="col-12 mt-3"><img class="img-thumbnail" src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/375/984/311/297/656/original/312060a69a5acbbb.jpeg" alt="Link Preview Image" /></div></div>]]></description><link>https://board.circlewithadot.net/post/https://infosec.exchange/users/lennybacon/statuses/116375984332810101</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://infosec.exchange/users/lennybacon/statuses/116375984332810101</guid><dc:creator><![CDATA[lennybacon@infosec.exchange]]></dc:creator><pubDate>Thu, 09 Apr 2026 17:43:16 GMT</pubDate></item><item><title><![CDATA[Reply to Let me get this straight... on Thu, 09 Apr 2026 17:21:41 GMT]]></title><description><![CDATA[<p><span><a href="/user/wdormann%40infosec.exchange">@<span>wdormann</span></a></span> <span><a href="/user/mastodonmigration%40mastodon.online">@<span>mastodonmigration</span></a></span> eh what?</p><p> On Android it just shows "you have a new message". Was this an Apple or a Signal decision?</p>]]></description><link>https://board.circlewithadot.net/post/https://glasgow.social/users/craignicol/statuses/116375899440074610</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://glasgow.social/users/craignicol/statuses/116375899440074610</guid><dc:creator><![CDATA[craignicol@glasgow.social]]></dc:creator><pubDate>Thu, 09 Apr 2026 17:21:41 GMT</pubDate></item><item><title><![CDATA[Reply to Let me get this straight... on Thu, 09 Apr 2026 17:14:28 GMT]]></title><description><![CDATA[<p><span><a href="/user/wdormann%40infosec.exchange">@<span>wdormann</span></a></span> The default setting is that you get notified when you receive a message, because most people want those.</p>]]></description><link>https://board.circlewithadot.net/post/https://infosec.exchange/users/prism/statuses/116375871046113903</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://infosec.exchange/users/prism/statuses/116375871046113903</guid><dc:creator><![CDATA[prism@infosec.exchange]]></dc:creator><pubDate>Thu, 09 Apr 2026 17:14:28 GMT</pubDate></item><item><title><![CDATA[Reply to Let me get this straight... on Thu, 09 Apr 2026 17:07:07 GMT]]></title><description><![CDATA[<p><span><a href="/user/avuko%40infosec.exchange">@<span>avuko</span></a></span> <span><a href="/user/wdormann%40infosec.exchange">@<span>wdormann</span></a></span> I was rather shocked that this could even be possible yet actually occurring.</p>]]></description><link>https://board.circlewithadot.net/post/https://mastodon.sdf.org/users/Beachbum/statuses/116375842177693423</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://mastodon.sdf.org/users/Beachbum/statuses/116375842177693423</guid><dc:creator><![CDATA[beachbum@mastodon.sdf.org]]></dc:creator><pubDate>Thu, 09 Apr 2026 17:07:07 GMT</pubDate></item><item><title><![CDATA[Reply to Let me get this straight... on Thu, 09 Apr 2026 17:05:48 GMT]]></title><description><![CDATA[<p><span><a href="/user/avuko%40infosec.exchange">@<span>avuko</span></a></span> <span><a href="/user/wdormann%40infosec.exchange">@<span>wdormann</span></a></span> That’s partly why I’m asking because I disable notifications as soon as I purchase a phone. Locating my phone is important because I misplace it a lot. My location services it’s also always off. <br />I have a degree in IT, but it goes back to 2006 and so much has changed since then and honestly, I only keep up through what I read here on Mastodon. I thought doing these things would secure my privacy.</p>]]></description><link>https://board.circlewithadot.net/post/https://mastodon.sdf.org/users/Beachbum/statuses/116375836969842681</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://mastodon.sdf.org/users/Beachbum/statuses/116375836969842681</guid><dc:creator><![CDATA[beachbum@mastodon.sdf.org]]></dc:creator><pubDate>Thu, 09 Apr 2026 17:05:48 GMT</pubDate></item><item><title><![CDATA[Reply to Let me get this straight... on Thu, 09 Apr 2026 17:02:53 GMT]]></title><description><![CDATA[<p><span><a href="/user/wdormann%40infosec.exchange">@<span>wdormann</span></a></span> <span><a href="https://mastodon.world/@Mer__edith">@<span>Mer__edith</span></a></span> I was unaware notifications on iOS were stored in an on-device database even after they had been dismissed. That seems like an inefficient waste of storage - does anybody have a link to some Apple docs providing context about this database?</p>]]></description><link>https://board.circlewithadot.net/post/https://sueden.social/users/tdpsk/statuses/116375825490517283</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://sueden.social/users/tdpsk/statuses/116375825490517283</guid><dc:creator><![CDATA[tdpsk@sueden.social]]></dc:creator><pubDate>Thu, 09 Apr 2026 17:02:53 GMT</pubDate></item><item><title><![CDATA[Reply to Let me get this straight... on Thu, 09 Apr 2026 17:02:52 GMT]]></title><description><![CDATA[<p><span><a href="/user/avuko%40infosec.exchange" rel="nofollow noopener">@<span>avuko</span></a></span> <span><a href="/user/wdormann%40infosec.exchange" rel="nofollow noopener">@<span>wdormann</span></a></span> </p><p>Oh, but it's even worse than that.  From TFA:</p><blockquote><p>Authorities have turned to push notifications more broadly as an investigative strategy too; in June 404 Media reported Apple gave governments data on thousands of push notifications. Those were legal demands made to Apple, while the Prairieland case was about data from a device authorities had physical access to.</p></blockquote><p>This suggests that your <a href="https://infosec.space/tags/notifications" rel="tag">#<span>notifications</span></a> are sent home to <a href="https://infosec.space/tags/Apple" rel="tag">#<span>Apple</span></a>.  Why is that necessary? </p><p>I have further questions:</p><ul><li>Why, and for whose benefit, were notifications stored on the phone after the <a href="https://infosec.space/tags/Signal" rel="tag">#<span>Signal</span></a> app had been removed?  They were useless to the other of the phone.</li><li>How much of this vulnerability is shared with Android phones?</li></ul>]]></description><link>https://board.circlewithadot.net/post/https://infosec.space/users/CppGuy/statuses/116375825480225630</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://infosec.space/users/CppGuy/statuses/116375825480225630</guid><dc:creator><![CDATA[cppguy@infosec.space]]></dc:creator><pubDate>Thu, 09 Apr 2026 17:02:52 GMT</pubDate></item><item><title><![CDATA[Reply to Let me get this straight... on Thu, 09 Apr 2026 16:45:28 GMT]]></title><description><![CDATA[<p><span><a href="https://ieji.de/@omnicore">@<span>omnicore</span></a></span> <span><a href="/user/wdormann%40infosec.exchange">@<span>wdormann</span></a></span> <span><a href="/user/signalapp%40mastodon.world">@<span>signalapp</span></a></span> What I got from the article is what you said here: the weakness is in iPhone’s default behavior.</p>]]></description><link>https://board.circlewithadot.net/post/https://mastodon.social/users/grammasaurus/statuses/116375757041055454</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://mastodon.social/users/grammasaurus/statuses/116375757041055454</guid><dc:creator><![CDATA[grammasaurus@mastodon.social]]></dc:creator><pubDate>Thu, 09 Apr 2026 16:45:28 GMT</pubDate></item><item><title><![CDATA[Reply to Let me get this straight... on Thu, 09 Apr 2026 16:32:21 GMT]]></title><description><![CDATA[<p><span><a href="/user/awkwardturing%40infosec.exchange">@<span>AwkwardTuring</span></a></span> <br />Right. That's the million dollar question.</p>]]></description><link>https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116375705429214117</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116375705429214117</guid><dc:creator><![CDATA[wdormann@infosec.exchange]]></dc:creator><pubDate>Thu, 09 Apr 2026 16:32:21 GMT</pubDate></item><item><title><![CDATA[Reply to Let me get this straight... on Thu, 09 Apr 2026 16:31:43 GMT]]></title><description><![CDATA[<p><span><a href="/user/wdormann%40infosec.exchange">@<span>wdormann</span></a></span> what does that mean for any other app that pushes sensitive data as notifications? Wondering if disabling the notification rly disables the storing in the DB or just the display of it.</p>]]></description><link>https://board.circlewithadot.net/post/https://infosec.exchange/users/AwkwardTuring/statuses/116375702946903500</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://infosec.exchange/users/AwkwardTuring/statuses/116375702946903500</guid><dc:creator><![CDATA[awkwardturing@infosec.exchange]]></dc:creator><pubDate>Thu, 09 Apr 2026 16:31:43 GMT</pubDate></item><item><title><![CDATA[Reply to Let me get this straight... on Thu, 09 Apr 2026 15:59:02 GMT]]></title><description><![CDATA[<p><span><a href="/user/beachbum%40mastodon.sdf.org" rel="nofollow noopener">@<span>Beachbum</span></a></span> <span><a href="/user/wdormann%40infosec.exchange">@<span>wdormann</span></a></span> if you do not want to be tracked/traced/placed, don’t bring a mobile phone in any way tied to you or your previous locations.</p><p>I worked in telco for years, trust me on this one.</p><p>The problem here was different: people who thought they were communicating privately, had their messages (or those that ended up in Apple’s notifications database on the iPhone) accessible to law enforcement. Even after (taking precautions like) deleting the app.</p>]]></description><link>https://board.circlewithadot.net/post/https://infosec.exchange/users/avuko/statuses/116375574432822811</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://infosec.exchange/users/avuko/statuses/116375574432822811</guid><dc:creator><![CDATA[avuko@infosec.exchange]]></dc:creator><pubDate>Thu, 09 Apr 2026 15:59:02 GMT</pubDate></item><item><title><![CDATA[Reply to Let me get this straight... on Thu, 09 Apr 2026 15:53:01 GMT]]></title><description><![CDATA[<p><span><a href="https://ieji.de/@omnicore" rel="nofollow noopener">@<span>omnicore</span></a></span> <span><a href="/user/signalapp%40mastodon.world" rel="nofollow noopener">@<span>signalapp</span></a></span> <br />Regardless, even just testing things out on a clean test device, an iPhone with Lockdown Mode enabled still gets push notifications with the incoming message body.</p><p>So, color me skeptical that Lockdown Mode does anything regarding this.</p>]]></description><link>https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116375550770399037</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116375550770399037</guid><dc:creator><![CDATA[wdormann@infosec.exchange]]></dc:creator><pubDate>Thu, 09 Apr 2026 15:53:01 GMT</pubDate></item><item><title><![CDATA[Reply to Let me get this straight... on Thu, 09 Apr 2026 15:50:26 GMT]]></title><description><![CDATA[<p><span><a href="https://mastodon.world/@Mer__edith" rel="nofollow noopener">@<span>Mer__edith</span></a></span> <br />Can we get a comment on this?</p><p>1) The default Signal setting to show message contents in push notifications seems... bad, assuming this article is accurate.<br />2) Does changing the in-Signal-app setting for Notification Content indeed prevent notifications from being stored <strong>anywhere</strong>, which by default contains incoming message <strong>bodies</strong>.</p>]]></description><link>https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116375540649392945</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116375540649392945</guid><dc:creator><![CDATA[wdormann@infosec.exchange]]></dc:creator><pubDate>Thu, 09 Apr 2026 15:50:26 GMT</pubDate></item><item><title><![CDATA[Reply to Let me get this straight... on Thu, 09 Apr 2026 15:44:43 GMT]]></title><description><![CDATA[<p><span><a href="/user/avuko%40infosec.exchange">@<span>avuko</span></a></span> <span><a href="/user/wdormann%40infosec.exchange">@<span>wdormann</span></a></span> I have Alerts for almost all of my apps turned off. I only have them on for find my phone and emergency, Public Safety and Amber Alerts. Do I need to turn those off also?</p>]]></description><link>https://board.circlewithadot.net/post/https://mastodon.sdf.org/users/Beachbum/statuses/116375518181444076</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://mastodon.sdf.org/users/Beachbum/statuses/116375518181444076</guid><dc:creator><![CDATA[beachbum@mastodon.sdf.org]]></dc:creator><pubDate>Thu, 09 Apr 2026 15:44:43 GMT</pubDate></item><item><title><![CDATA[Reply to Let me get this straight... on Thu, 09 Apr 2026 15:24:15 GMT]]></title><description><![CDATA[<p><span><a href="/user/wdormann%40infosec.exchange">@<span>wdormann</span></a></span> The default setting for the <em>iPhone</em> by the US company <strong>Apple</strong> is to pass messages through to their Notification functionality.</p><p>They could be retrieved by the FBI from the US company <strong>Apple</strong>'s push notification database.</p><p>The US company <strong>Apple</strong>, not <em>Signal</em>, has a shoddy security model here.</p><p>PS: To any Apple fanboys who can't stand a single bad word about Apple, I'll block you permanently and happily if you even give a squeak.</p><p><a href="https://infosec.exchange/tags/Apple" rel="tag">#<span>Apple</span></a> <a href="https://infosec.exchange/tags/Signal" rel="tag">#<span>Signal</span></a> <a href="https://infosec.exchange/tags/FBI" rel="tag">#<span>FBI</span></a> <a href="https://infosec.exchange/tags/Fascism" rel="tag">#<span>Fascism</span></a></p>]]></description><link>https://board.circlewithadot.net/post/https://infosec.exchange/users/avuko/statuses/116375437693191846</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://infosec.exchange/users/avuko/statuses/116375437693191846</guid><dc:creator><![CDATA[avuko@infosec.exchange]]></dc:creator><pubDate>Thu, 09 Apr 2026 15:24:15 GMT</pubDate></item><item><title><![CDATA[Reply to Let me get this straight... on Thu, 09 Apr 2026 15:19:19 GMT]]></title><description><![CDATA[<p><span><a href="https://ieji.de/@omnicore" rel="nofollow noopener">@<span>omnicore</span></a></span> <span><a href="/user/signalapp%40mastodon.world" rel="nofollow noopener">@<span>signalapp</span></a></span> <br />Yeah, I've been on Lockdown Mode since it was released.</p><p>Do you have a reference for how this is the case?</p>]]></description><link>https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116375418285543596</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116375418285543596</guid><dc:creator><![CDATA[wdormann@infosec.exchange]]></dc:creator><pubDate>Thu, 09 Apr 2026 15:19:19 GMT</pubDate></item><item><title><![CDATA[Reply to Let me get this straight... on Thu, 09 Apr 2026 15:09:18 GMT]]></title><description><![CDATA[<p><span><a href="/user/wdormann%40infosec.exchange">@<span>wdormann</span></a></span> ok ... I wonder if changing this option would make any difference unless notifications are fully disabled <img src="https://board.circlewithadot.net/assets/plugins/nodebb-plugin-emoji/emoji/android/1f914.png?v=28325c671da" class="not-responsive emoji emoji-android emoji--thinking_face" style="height:23px;width:auto;vertical-align:middle" title="🤔" alt="🤔" /></p>]]></description><link>https://board.circlewithadot.net/post/https://framapiaf.org/users/bsod/statuses/116375378899895859</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://framapiaf.org/users/bsod/statuses/116375378899895859</guid><dc:creator><![CDATA[bsod@framapiaf.org]]></dc:creator><pubDate>Thu, 09 Apr 2026 15:09:18 GMT</pubDate></item><item><title><![CDATA[Reply to Let me get this straight... on Thu, 09 Apr 2026 15:04:23 GMT]]></title><description><![CDATA[<p><span><a href="https://framapiaf.org/@bsod" rel="nofollow noopener">@<span>bsod</span></a></span> <br />They had access to an unlocked device.</p><p>Unclear whether that was voluntary, through coercion, or through trickery like Cellebrite advertises.</p>]]></description><link>https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116375359582754044</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116375359582754044</guid><dc:creator><![CDATA[wdormann@infosec.exchange]]></dc:creator><pubDate>Thu, 09 Apr 2026 15:04:23 GMT</pubDate></item><item><title><![CDATA[Reply to Let me get this straight... on Thu, 09 Apr 2026 15:01:59 GMT]]></title><description><![CDATA[<p><span><a href="/user/wdormann%40infosec.exchange">@<span>wdormann</span></a></span> I mean, before 2025 did the average mainstream user have the US government in their threat model?</p>]]></description><link>https://board.circlewithadot.net/post/https://hachyderm.io/users/marypcbuk/statuses/116375350114734656</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://hachyderm.io/users/marypcbuk/statuses/116375350114734656</guid><dc:creator><![CDATA[marypcbuk@hachyderm.io]]></dc:creator><pubDate>Thu, 09 Apr 2026 15:01:59 GMT</pubDate></item><item><title><![CDATA[Reply to Let me get this straight... on Thu, 09 Apr 2026 15:00:28 GMT]]></title><description><![CDATA[<p><span><a href="/user/wdormann%40infosec.exchange">@<span>wdormann</span></a></span> how the FBI could access the device notifications database?</p>]]></description><link>https://board.circlewithadot.net/post/https://framapiaf.org/users/bsod/statuses/116375344121233599</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://framapiaf.org/users/bsod/statuses/116375344121233599</guid><dc:creator><![CDATA[bsod@framapiaf.org]]></dc:creator><pubDate>Thu, 09 Apr 2026 15:00:28 GMT</pubDate></item></channel></rss>