Why Signal Calls Google
I just started my de-googling journey recently, and so the mechanics of notifications were still unclear to me, and I found this video super helpful.
It explains how most mobile messaging apps (including privacy-focused ones like Signal) rely on Google and Apple's centralized servers to deliver push notifications, which exposes vast amounts of user metadata.
Here's the YT link, for people who prefer it:
youtu.be/c3ennD3wKn0
Merle: Why Even Signal Calls Apple & Google
https://media.ccc.de/v/gpn24-502-why-even-signal-calls-apple-googleI just wanted Zulip notifications on my phone. So I started building something myself - an...media.ccc.de (YouTube)
Carlos Solís
in reply to 45o3b • •DeGoogle Yourself reshared this.
redjard
in reply to Carlos Solís • • •You can use push providers if you trust them. For example mozilla hosts one.
The MollySocket service also does not need and does not have decryption keys, only keys to request encrypted messages from signal servers. Still not something I would want to run on someone elses server without serious privacy considerations.
Carlos Solís
in reply to redjard • •DeGoogle Yourself reshared this.
skyline2
in reply to Carlos Solís • • •Carlos Solís
in reply to skyline2 • •ntfyallows public access to all items with theupprefix in the settings.DeGoogle Yourself reshared this.
Carlos Solís
in reply to Carlos Solís • •DeGoogle Yourself reshared this.
ilovesaggytits:)
in reply to Carlos Solís • • •non_burglar
in reply to 45o3b • • •That is correct.
However, this is a quasi-monopoly by google having quietly overwhelmed the space. Same thing for RCS messaging.
Neither push notifications nor RCS are proprietary, so there is a possibility to tear oneself from google here.
For instance, there are several free and paid push notifications services. Pushbullet is a popular paid one, not too expensive. I personally use ntfy.sh/, which can be self-hosted.
RCS is different because trusting the encryption keys makes RCS work, so there would have to be a critical mass of buy-in to use an alternative to google's RCS implementation.
Voxel
in reply to non_burglar • • •RCS is off-topic.
Regarding Push, there is UnifiedPush which has already seen a wide adoption, e.g. Matrix. That's also the one used by Nfty. It's free and opensource and can be used by anyone.
non_burglar
in reply to Voxel • • •Disagree, it serves to illustrate the same kind of monopoly google has one push notifications.
UnifiedPush is not a push service, it is a distributor. It is a proxy for push services, it does not send out its own notifications.
Also, ntfy does not need to use unified push, it simply makes put or post notifications, like it does in the self-hosted version. For instance, I do not want my http push notifications flying around in plain text with notifications about my private services being up or down, so I don't use one. I arrange the connectivity to my applications myself.
Here again, google has done us all a disservice by obscuring the difference.
Aporia
in reply to 45o3b • • •From what I recall, Google would be able to see our device received a notification and when but not the actual message nor sender/recipient identity.
I think that's fine for my threat model.
Molly seems like a potential alternative though since its a signal fork and supports UnifiedPush so you can choose a different notification supplier like ntfy or sunup
Squizzy
in reply to Aporia • • •SamuelEllis
in reply to 45o3b • • •