How the FBI recovered Signal messages (and how to fix the flaw)

For years, the Signal messaging app has been a favorite for privacy-minded folks. However, it’s not perfect.

404 Media reported this week that the FBI was able to read a suspect’s Signal messages, which should not normally be possible. Signal messages are end-to-end encrypted, meaning only the sender and receiver should be able to read them. They also disappear over time, so as not to leave a trace. In this case, the user had also deleted the app off of their phone.

So, how did the FBI see the messages? By reportedly extracting them from an iPhone’s push notification database, of course. If messages are displayed in a push notification, that technically skirts the whole encryption problem, making it possible for a third party to read them. This is true of any app with push notifications, not just Signal.