I remember reading an article where the government and Google were able to read notifications and record them from every android device. I wonder if Graphene might have patched this problem, and if not, do they have any plans to do so?
Thanks!
The issue lies with Google’s FCM (Firebase Cloud Messaging) system, so it’s not something GrapheneOS can really fix. As far as I know FCM doesn’t offer a way to encrypt notification content. Some apps like Signal work around this by instead of sending the message content, they send a little “wake up” notification. This tells Signal on your phone to wake up and it goes and retrieves the new message.
If you don’t install Google Play Services, you won’t be impacted. But you’ll also not get notifications for most applications. There is an alternative push notification system called UnifiedPush which allows you to choose any server to handle your notifications (and even self host it). But it does require both the service and the app to support it, so it’s not very wide spread yet.
Why do we need a server to handle notifications anyway? Why isn’t it local to the device?
It’s mostly a power efficiency thing. Before push notifications were the norm, most apps used a polling method. They had the application send a request every X seconds asking “anything new”. There wasn’t coordination between apps, so even every app checked once every 30s, it likely wouldn’t be on the same 30s. This caused the device to wake up a lot and never let it switch into low power mode.
A push notifications system like FCM or UnifiedPush means only a single application needs to run in the background. It maintains a persistent connection to the push notification service and waits for a message. When it receives one it wakes up the relevant app and passes it the details.