Push notifications and privacy

You can have a super secure message, but if it appears on your lock screen in plain text, anyone holding your phone can read it. This post is geared toward anyone, and you don't have to have a special phone to be affected or find this helpful.

Scroll to the bottom for a little explanation of what encryption the process of turning readable data into a secret code and secure messaging sending messages via apps designed to keep conversations private apps are if you're not familiar.

Where did my notifications go?

When I first took stock Android the system running most smartphones (like Pixel, Samsung, LG, etc) off my phone and put Graphene An alternative to Android or iOS on phones. on, I waited to see updates about my son via the day care app, but I didn't see the usual updates at the usual times ping on my phone. My push notifications pop ups on your phone that alert you to messages from your friends or apps weren't coming through. I read some things online, and found out that I needed to install Google Play Services (or potentially an app called microG) for them to work. I had never really thought about how push notifications pop ups on your phone that alert you to messages from your friends or apps worked. To be honest, I only learned that's what they were called because of PTA work, so within the last 10 years. I was curious about how this all worked, so I didn't stop there, and what I found out might surprise you.

As a workaround, some apps give you the option to notify via e-mail or SMS standard text messages sent over cellular networks (usually not encrypted) , but this one app I rely on doesn't have that functionality yet. They have daily email summaries, but I need to know when the day care messages me.

Why big tech is often in the middle

Many apps for Android the system running most smartphones (like Pixel, Samsung, LG, etc) rely on Google's services for push notification handling. I was surprised at how many apps rely on this single dependency. They assume Google is necessary and always there. It makes sense. Big tech has built a lot of infrastructure and refined it over the years. It's difficult for smaller companies or efforts to compete and to match the reliability. It feels like nobody else comes close. However, push notifications pop ups on your phone that alert you to messages from your friends or apps work for me on Signal and Proton mail without Google Play Services installed, so there are other ways to make these notifications work.

What can others see from your messages?

As I started looking further in to notifications and how they work, I came across something more interesting that I didn't know before. I realized I had no understanding of the flow of information that is actually happening for each bell or "ping" I hear. There are interesting things going on related to how visible your information is. So then I wondered, as my day care app showed me a great photo of my son painting, who can see this? The daycare? Google? Just me?

There are two things going on here.

• Message - We have the message itself, which may or may not be scrambled/encrypted.
  • "Meet me at 4"
• Delivery - Then there's the way the message goes from one person to another, and what extra information, or metadata information that describes other data (e.g. time a message was sent, who sent it, etc) , is attached to the message.
  • Sent by Bobby, Recipient is Flora, Sent at 2:53 pm Central Time USA, size 1kb,

Plain messages vs encrypted messages

Starting with text messaging, some texts are sent as SMS standard text messages sent over cellular networks (usually not encrypted) or MMS text messages that include photos or videos (usually not encrypted) messages. Those are not generally end-to-end encrypted describes a message that is locked from sender to receiver . In late 2024, after discovery of a compromise of US telecomm providers by a hacking group, the FBI and CISA encouraged Americans to use end-to-end encrypted messaging apps when possible. This makes messages difficult for third parties to read even if they're able to access the data while it's being sent from one person to another.

I remember hearing this at the time and thinking, well, ok, use encrypted messaging (e.g. Signal, Telegram, Viber, etc) and you're protected, right? Yes, with some settings.

Message metadata information that describes other data (e.g. time a message was sent, who sent it, etc)

Some news I had missed the prior year was that secure messaging sending messages via apps designed to keep conversations private apps have their own vulnerabilities in a computer system or program, vulnerability refers to a weakness that a hacker could use to get in or get more access . The notification system is separate from the message itself. Many of these secure messaging sending messages via apps designed to keep conversations private apps rely on Apple or Google to deliver their notifications. When something happens in the digital world, there's often a lot of metadata information that describes other data (e.g. time a message was sent, who sent it, etc) attached. This might include when something was created, who created it, what format it's in, how it's organized, who is it for, and so on.

In 2023, United States Senator Ron Wyden brought public attention to the fact that governments had been obtaining push notification records from Apple and Google. Push notifications pop ups on your phone that alert you to messages from your friends or apps happen in the middle of the communication process (see this blog for a nice visual), and the metadata information that describes other data (e.g. time a message was sent, who sent it, etc) , the data about the message, like who sent it, what time, phone numbers, and more, are sometimes visible depending on how the app sets things up and how Google and Apple handle the communication.

I wondered how much information apps place inside the notifications. Sometimes I get a notification from the day care app that there's a new photo. Sometimes it just says "New photo!" Sometimes I get the actual photo in the notification. Who can see that? It's hard to know for sure.

Encrypted messages aren't as private as you think

Researchers have looked into this, too. One study from 2024 looking at 21 popular secure messaging apps found that many exposed information through a service from Google, called Firebase Cloud Messaging (FCM). This is the one frequently used for push notifications pop ups on your phone that alert you to messages from your friends or apps , and the one some of my critical apps use. Eleven of the secure apps in the study leaked identifying metadata information that describes other data (e.g. time a message was sent, who sent it, etc) such as user IDs, sender names, recipient names, or phone numbers. Four of the apps transmitted actual message content through push notification payloads. The researchers also noted that this information generally was not disclosed in the apps' privacy statements.

Encrypting the messages is one piece of a larger system. Message contents, notification previews, sender names, metadata information that describes other data (e.g. time a message was sent, who sent it, etc) , and device storage can all have different privacy levels.

Recent examples

Recently, there was a separate case involving the Signal app. Signal's encryption the process of turning readable data into a secret code was not broken; instead, investigators obtained access to a suspect's unlocked iPhone and were able to recover incoming message data that had been stored locally by iOS the system running Apple iPhones and iPads . The notification was a separate source of information, and it was being stored on the phone by processes other than Signal. Here's another source that doesn't have pop ups/paywall and tells you how to set your notifications within Signal to not show message content.

Conclusion

I really hadn't thought about how these notifications persisted or how they're part of this whole world of services and traffic beyond my control. I didn't realize how much they're part of a larger network of services that collect so much data on us.

One reason I want to share these stories is because I think it's important to have a basic understanding of the tools we depend on everyday. But even as a technical person, I find it tough to keep up with ever changing features, configurations, changes, and terms of service. Tech moves fast.

You matter

The encouraging part of these stories is that your awareness matters. You can share what you learn with your representatives, and we've seen public opinion make real change. We've seen various reactions to public opinion in the past few years. Some representatives flee from town hall meetings, and others are willing to face hard questions. Some are willing to make changes that protect user rights over corporate convenience. Some have an interest for us to be tied to devices and services that leak incredible amounts of personal information.

Companies respond to pressure as well. After public scrutiny of government requests for push notification records, Apple changed its policies, requiring legal warrants instead of informal requests.

The broader lesson is that people can only ask questions and push back when they know what's going on. Visibility creates pressure, and pressure can create change.

What can I do today?

I wish I could tell you exactly what behavior will happen with your app and your phone, and it seems like no one can tell us for sure.

Check your notification settings

Go to Settings > Notifications and turn off "Show sensitive content on lock screen."

For your most important messaging apps, check the settings within the app for how much you want it to share.

In Signal, for example, you can go to:
Settings > Notifications > Customize in the Messages section > Lock screen > "Show sensitive content only when unlocked"
They don't have an option to just show who it's from on mine when I checked just now.

Ask your critical apps

Look at your app settings. What do you see? Are there any settings you'd like to turn on or learn more about? Think about what you want others to see when your banking app sends you a message, or your friend texts you.

Use a password manager

A password manager is typically considered the safest way to deal with keys and passwords. I choose a local-only encrypted database, because I don't feel comfortable with the cloud data breaches I've seen of the big name brands. I know a lot of people use these services and aren't as concerned with that risk. I'd be willing to use it for logins that aren't tied to credit cards or e-mail.

Definitions of encryption the process of turning readable data into a secret code and secure messaging sending messages via apps designed to keep conversations private apps

What are encryption the process of turning readable data into a secret code and secure messaging sending messages via apps designed to keep conversations private apps?

Encryption the process of turning readable data into a secret code turns data or messages into text that can't be understood unless you have the key to unlock it. For example, it might be like you send a letter in a locked box and only you and the recipient have the key to unlock that box.

Secure messaging sending messages via apps designed to keep conversations private apps use encryption the process of turning readable data into a secret code to keep conversations private. The company that makes the app can't read your messages. It's like a private phone call vs shouting across a crowded room.