I see DC has introduced FCM Push Notifications for Android and I give my perspective of the risk analysis below, but first I have some questions about this.
-
If I turn off FCM Push in the settings, does this mean my phone will never send my device token to the chatmail server, or will it still send my device token to the chatmail server and just stop the DC notification proxy from sending the notfication to FCM server?
-
If I have already turned on FCM Push in the settings and my device token has already been sent to the chatmail server, will my device token be deleted from the chatmail server when I turn off FCM Push, or will it stay on the chatmail server indefinitely?
-
When I upgrade to the new version of DC with FCM support, will FCM Push be enabled by default, disabled by default, or will I be prompted to choose?
-
I read that support for UnifiedPush and alternative Push providers is currently being considered for future releases. So if the benefit of FCM is that it reliably wakes up background apps while IMAP Push does not (depending on the OS), where does UnifiedPush and alternative Push providers fit into the picture? Do they reliably wake up apps the same as FCM or are they more like IMAP Push in this respect?
I read the following claim on the DC FAQ:
Resulting from this overall privacy design, even the seizure of a chatmail server, or the full seizure of the central Delta Chat notification proxy would not reveal private information that Push services do not already have.
I do not believe this claim is correct. While I appreciate that DC is trying to make DC more convenient for users and DC has put a lot of effort into the privacy design, the FAQ still understates the risk.
Maybe there are aspects of the implementation which I don’t understand, so you can correct me if I’m wrong, but I give some examples below based on my understanding.
Example 1:
Lets say police take interest in an anonymous account because its been used for whistleblowing or activism or whatever. If they seize or subpoena the chatmail server, now they can instantly find out all other accounts used by the same user on the server, which might allow them to both trivially deanonymize the whistleblower/activist account and also start to map personal contacts of the whistleblower/activist.
Therefore the new FCM integration makes it impossible for multi-account users to maintain seperation between accounts and it makes deanonymization easier. Contrary to the claim in the FAQ, the seizure of a chatmail server, or the full seizure of the central Delta Chat notification proxy would reveal private information that Push services do not already have.
Example 2:
If the police also go to Google for information about the push token (and it is well documented that they routinely do this) then they might be able to deanonymize the account (if they haven’t already) if the user has a Google account in their own name or tied to a personal Gmail account, and they can also learn which other apps the user is using.
Again, this can reveal private information that Push services do not already have, contrary to the claim in the FAQ.
With these above examples, I am concerned not only about the immediate risks to users posed by deanonymization and linking accounts but also the fact that chatmail servers and the DC notification proxy will become a more valuable target for seizure.
Example 3:
Google can infer who’s chatting to who and when by correlating the timestamps of push notifications. Obviously this also enables police or governments with access to Google push logs to connect users like this, more efficiently and with need for less resources then they otherwise would (they only need to monitor the central Google push server instead of the whole internet, and they can filter for push tokens sent by the DC push notification proxy).
This can reveal private information even without seizure of a a chatmail server or the DC notification proxy. Without DC’s new FCM integration, Google would not necessarily have this information, and it would be more costly for police and governments to get this information.
So while we can easily recognize the convenience which FCM brings, and we can also acknowledge that DC has made a good effort to mitigate the worst of the risk like exposure of message details, we should also be honest about the risks it poses and accurately inform users about this. This will help users make informed choices according to the level of threat they face and it can help developers and contributors to consider new ways to address the shortcomings of the current design and improve the overall privacy design.