1

Assumption

My question assumes the following situation, that is what I could understand about Google's push notifications system. If I misunderstood anything, please correct me here.

When a web service wants to send a notification to a user who installed its app (client), it sends the notification content to Google's push notification server. The server then contacts the user's device instructing it to show the notification.

This system prevents user's device from continously checking for notification, that would cause battery drainage and other annoying side-effects. However, some privacy concerned people point out that it allows Google to access all the notification contents, including for example private messages.

Question

If I have an app (client) that manages* notifications on my device for a web service and doesn't have an option to disable them, the only way I can prevent them to be shown is through Android settings. To my understanding, if I do so the web service (that doesn't know my Android settings) will still send notification contents to Google's server, thus allowing Google to know notification content, but the server won't send it to my device. So, disabling notifications through Android settings wouldn't have any effect on privacy. Is that right?

*I use the word "manage" because usually the notifications are shown if and only if the app is installed and it often has settings for them (sound selection, vibrate and so on); however, I don't know how much notifications depend on the app and how much on the system. Anyway, it looks to me that it is not very important for the question (but I might be wrong of course).

7
  • Are you sure the app sends notifications? The rest of your question is about receiving notifications. Are those notifications individual notifications or mass notifications (sent to a larger group)?
    – Robert
    Apr 29 at 9:32
  • It's not the app which sends notification, it's the web service that sends notification to Firebase server which is then sent to the device. Then it is delivered to the app for processing which is when e2ee messages are decrypted. It's private if there's encryption. Silencing notification doesn't stop this process.
    – defalt
    Apr 29 at 12:00
  • @Robert In fact the notification is sent from the web service (thanks to defalt for pointing that out) the app is a client for; I corrected the question. About individual vs mass notifications, if you mean if they are sent to one user only or to many users (e.g. WhatsApp private message vs WhatsApp message in a WhatsApp group) I'd like to understand the answer for both the situations.
    – Ntakwetet
    Apr 29 at 13:20
  • No, I don't think WhatsApp groups have an own Firebase Push address. I was talking about messages sent to a large group of users (typically 100 to 100k).
    – Robert
    Apr 29 at 13:24
  • 1
    Encrypted notification content is not mandatory. Most notifications are public info. For e2ee messaging, the content is already encrypted by the sender.
    – defalt
    Apr 29 at 15:01
1

Push messages - what do they contain

What data each app receives via Firebase push notifications can be very different.

Some apps receive the complete message content as Firebase push notification to the user's app. In such a case Google can of course see the complete message.

Apps that handle privacy related content should use push notifications not as data transmission system. Instead they use push notifications just as notification for the app that new data is available on their own WhatsApp/Signal/... server.

Therefore for messenger apps I would expect that the push notifications may just contain e.g. a number the app processes and then knows that new data is available on the server.

Disabling notifications for an app

Regarding the question what happens if you disable notifications of an app in settings this also depends on the app:

The app itself can check if you have enabled/disabled a certain push channel. Therefore it is possible for an app to disable the notifications on server side so that no push messages are sent at all if you have disabled notifications for that app.

However a lazy app developer may not implement such a check. In such a case I would assume that all notifications are sent as before but just ignored by your device.

2
  • Some apps send the complete message content as Firebase push notification to the user's app -- I'm confused. Is the former highlighted term "apps" something different than what we users know as "apps"? Because I feel like this "apps" term here denotes something other than Android apps. And this "apps" (it is a web app) uses Firebase to send messages to the user installed app.
    – Firelord
    Apr 29 at 15:01
  • 1
    @Firelord Correct, it is better to write "receive" then it doesn't matter what server back-end is used (even if this makes it a bit unprecise as notifications that contain the complete message can be displayed by Android itself without having to "wake" the app at all). From the user perspective only the app itself installed on the device is called "app" but from a developer perspective often the term "app" comprises also the used back-end servers.
    – Robert
    Apr 29 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.