6 ms·
Apps (such as Signal) that care about end-to-end encryption do their own key management. So, Apple / Google servers only ever see ciphertext, and don't have acc
by pcl 5mo ago
Apps (such as Signal) that care about end-to-end encryption do their own key management. So, Apple / Google servers only ever see ciphertext, and don't have access to the key material that's used for the encryption.
- toast0 5mo agoAfaik, e2e messengers don't include ciphertext with push notifications. It's an empty push to wake the client. Then the client contacts the origin to fetch the ciphertext.
- saagarjha 5mo agoThis is how it used to work; notifications can be encrypted now and Signal uses an extension to decrypt them.
- pseudalopex 5mo agoA Signal developer 12 days ago said Our FCM and APN notifications are empty and just tell the app to wake up, fetch encrypted messages, decrypt them, and then generate the notification ourselves locally.[1] [1] https://news.ycombinator.com/item?id=47723445 https://news.ycombinator.com/item?id=47723445
- saagarjha 5mo agoAh, yes, they would be right. I feel like I had read that someone had migrated at some point, maybe it was WhatsApp or something.