Push notification token privacy

1fexd

Does GrapheneOS provide any protection against Sandboxed Play services linking Push notification tokens stored and used by apps on device to the Google account signed into the device? Would that even be possible? (Threema describes a hypothetical scenario here, in which a user is deanonymized by linking the push token stored with a Threema ID to their Google account through subpoenas)

DeletedUser559

If multiple people in the same chat group (eg WhatsApp or Signal) used Google Play Services then it would only take a few messages to the group to correlate the users and assume they are in the same group. I'd be surprised if Google doesn't do this already.

You can avoid Google Play Services by using Molly instead of Signal. For WhatsApp, unless I'm mistaken it was previously possible to download the apk directly from their website that used their own WhatsApp push service, but it links to Google Play Store now.