• Chobbes@lemmy.world
    link
    fedilink
    English
    arrow-up
    12
    arrow-down
    1
    ·
    edit-2
    11 months ago

    Signal push notifications don’t contain any useful plain text data (no content, no information about who sent you a message). AFAIK the only thing you would be leaking is that you received a message on signal, and frankly that metadata is probably going to be leaked to the US government regardless of your use of push notifications.

    • notenoughbutter@lemmy.ml
      link
      fedilink
      English
      arrow-up
      2
      arrow-down
      1
      ·
      11 months ago

      frankly that metadata is probably going to be leaked to the US government regardless of your use of push notifications.

      How?

      • Chobbes@lemmy.world
        link
        fedilink
        English
        arrow-up
        6
        ·
        11 months ago

        Because your ISP and cell phone provider can tell you’re connecting to signal.

        • Natanael@slrpnk.net
          link
          fedilink
          English
          arrow-up
          3
          ·
          11 months ago

          They can tell you connect to AWS when the Signal app fetches messages after a notification, they need to be able to peek into Amazon’s servers to see you’re connecting specifically to Signal

          • Chobbes@lemmy.world
            link
            fedilink
            English
            arrow-up
            3
            ·
            edit-2
            11 months ago

            AWS is not a black box from the outside. The signal servers will have their own external IP addresses that you will connect with, your ISP could keep track of those connections. Furthermore, if you are worried that the government is using your ISP to spy, what makes you think that AWS wouldn’t be subject to that as well? Signal is absolutely a target in this respect too.

            Of course you can do various things to potentially hide your connection to signal, for instance by using tor, but in some sense there’s no guarantee if you don’t trust anything external to you. I’m personally not too worried about the “this person uses signal” metadata, though.

            • Natanael@slrpnk.net
              link
              fedilink
              English
              arrow-up
              1
              ·
              edit-2
              11 months ago

              There’s not enough unique IP addresses to distinguish Signal servers, if you don’t explicitly set up static IP addresses you’re going to share an IP pool

              https://docs.aws.amazon.com/vpc/latest/userguide/aws-ip-ranges.html#aws-ip-download

              Sure they could tap into AWS (but it would be even easier to try to get data from Google Play Store on who has it installed).

              Signal has native support for proxying via Tor in that case.

              • Chobbes@lemmy.world
                link
                fedilink
                English
                arrow-up
                1
                ·
                11 months ago

                The signal servers will absolutely have public and static IP addresses. You would not be able to connect to them reliably if they could change at any time and you had to rely upon DNS updates to find the server. AWS is not magic.

                And yes, AWS has IP ranges allocated to it that they pull their public IPs from, that’s all that link is talking about — this page even provides the context that the IP ranges are available in order to identify which traffic is coming from AWS in order to allow / disallow it. Of course the AWS IP allocations won’t tell you which IP is associated with which service (and indeed many IPs, particularly in the IPv6 space, are probably not in use at all).

                There’s not enough unique IP addresses to distinguish Signal servers

                Why? Yes, IPv4 address exhaustion is a thing, and yes AWS only has a slice of IPv4 addresses to give, but you absolutely can get static public facing IPs from AWS that will be unique to your server. You can even pay for an elastic IP so you can hold a particular address and move it between instances. There is no way Signal does not do this.

                Signal has native support for proxying via Tor in that case.

                Yes, though the use case is mostly for getting around censorship. Realistically if you don’t want the government to know you’re using Signal… Do you want them to know you use Tor?

                • Natanael@slrpnk.net
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  ·
                  11 months ago

                  FYI, SNI is a thing (included encrypted SNI these days) and you absolutely can share an IP among many many unrelated domains.

                  Domain lookups have a TTL (time to live) and they stop advertising IPs which they’ll stop using a little bit before those IP addresses are taken out of rotation. That’s why it doesn’t break even when addresses keep changing.

                  Signal have an active incentive NOT to use static IP addresses!

                  https://support.signal.org/hc/en-us/articles/360007320291-Firewall-and-Internet-settings

                  The underlying IPs are constantly changing, so it’d be hard to define accurate firewall rules.

                  Realistically if you don’t want the government to know you’re using Signal… Do you want them to know you use Tor?

                  Probably not, but you don’t need to run the Tor client on the phone, you can run an anonymous proxy and point your phone at it.

    • Still@programming.dev
      link
      fedilink
      English
      arrow-up
      4
      arrow-down
      4
      ·
      11 months ago

      it’s not the content in the noti, it’s where your phone was connected when it received it