Curious about this too. From what I could find, for those it seems like the push is being used to wake up the app and tell it to connect to the server where it grabs the data and then creates the notification locally. Even if a bare minimum is used there is room for traffic analysis, but it shouldn’t mean the contents of the displayed notification are necessarily what was sent through the server. It’s hard to find info without digging because consimer-facing stuff just calls every notification a push notification.
Comment on Governments spying on Apple and Google users through phone notifications, U.S. senator says
DangerousInternet@lemmy.world 9 months ago
Anyone could explain how push messages work? Let’s think about WhatsApp or Signal notifications, they contains lots of data, even if we think only about metadata, that is also a lot, if you try to find someone and examine tons of anonymous pushes to find ‘that needed’ ones? Seems possible. Um…
Bitrot@lemmy.sdf.org 9 months ago
AnEilifintChorcra@sopuli.xyz 9 months ago
For android, Google uses Firebase Cloud Messaging, basically a server that pings the phone when a notification for an app is available, which wakes the app up to receive the notification. There are alternatives but they need to be adopted by app devs for them to work.
For people running a degoogled android, they’ll notice most apps won’t receive any notifications until they open the apps since most apps rely on Google Play Services to receive a ping from FCM.
I don’t have any google play services so most of my apps don’t give me push notifications but I do have WhatsApp installed and that still receives notifications, they’re sometimes delayed by a few minutes which makes me think Meta have their own implementation/alternative to FCM but I’m not sure.
For Signal, their servers tell Googles FCM servers that you have notifications waiting on Signals servers and to wake up your Signal app so it can communicate with Signals servers to receive your messages.
WhatsApp and Signal claim/have end-end encryption on their messages but that shouldn’t matter when specifically looking at Googles FCM servers so, at most it would be meta data that could be obtained from the FCM servers.
jami.net/unifiedpush/ has a pretty basic explanation of push notifications on android and also showcases an alternative to FCM unifiedpush.org which has a nice little diagram about push notifications on android. Unfortunately, Unifiedpush is not widely adopted by many applications.
So there are ways to avoid Googles FCM servers on android using Unifiedpush or always having the application on in the background but for the most part FCM is used.
MonkderZweite@feddit.ch 9 months ago
Never had issues with Element, Fair Email, Silence notifying me? I run LineageOS without Play.
AnEilifintChorcra@sopuli.xyz 9 months ago
I’m pretty sure Element stays active in the background, it may have asked you to turn off battery optimisation and have a silent notification always active. This decreases battery life which is why most apps don’t do this but it allows the app to constantly ping the server to check for new messages and is one way around using FCM.
Fair email uses en.m.wikipedia.org/wiki/IMAP_IDLE instead of FCM, I’m no expert and this is just my guess but it seems to also need the app to run in the background for this to work.
Silence is SMS and MMS only and so doesn’t use internet and so has no need for FCM or any alternative anyway
MonkderZweite@feddit.ch 9 months ago
Right, yes, they do ask to disable battery optimization.
DangerousInternet@lemmy.world 9 months ago
Thanks. I also found, that push encryption is not native and requires extra work and libraries to implement, not all devs would care about it.