My notification setup

willow262

This is not strictly directly Graphene related and as such may be better suited as an off-topic, but I decided to put it here anyway.

I've only been using GOS for a handful of months, but I wanted to share how I've set up notifications for my primary profile. Maybe more experienced users have additional pointers for me or maybe it can help others who want to do the same.

The goal is to have my primary profile 100% Google free, and that any app I use that does not strictly need to be installed trough the Play Store (like bank apps and such that rely on the Play Integrity API and so on) should be on this profile. In other words, it does not have Google Play Service.

I'm sure most of us already know that practically all apps rely on GPS to deliver notifications over FCM. I wanted a way to get reliable notification for the apps I'm using where notifications are essential. Primarily messaging:

Signal
Telegram
Email

Just a short while ago I learned about UnifiedPush, an open standard for delivering notifications. Unfortunately, not many apps offer support for it. However, there are alternative clients for Signal and Telegram that do support it, so the first step was to get that set up.

I went for Molly as a Signal client and Momogram for Telegram, both of which implement UnifiedPush.

I set up ntfy on my home servers and installed the ntfy app on my phone, selecting it as the provider for UnifiedPush notifications for both the aforementioned apps. Telegram should start working already assuming the ntfy topic is publicly available (and writable). Molly needs an extra step since we need something to connect to Signal and send notifications when new messages are received. Luckily, the Molly team also gave us mollysocket.

In short, ntfy and UnifiedPush solves my IM notification needs which leaves email.

I have two email accounts.

A generic email provider for my business account for which I am using Thunderbird
Proton Mail for my person email

I very recently discovered imap-ntfy which seems like a simple and clever way to keep an idle connection to an IMAP server and send a notification whenever a new email is received. I took the liberty to rewrite the script to my own liking and run it using systemd, you can check it out here if you'd like. I've only been running it for a couple days and it seems to be working fine this far. I'd appreciate more testers submitting any bugs they can find.

Now I can send notifications for my business email and have it open Thunderbird when I click the notification.

Finally, to get my Proton Mail working I installed the Proton Mail Bridge on a VM (unforunately needs desktop), and created another imap-ntfy service for that one. Unfortunately, Proton does not offer any sort of deep linking for their Android app.

Now I have all the notifications I need (for now at least) working brilliantly with no Google what so ever. Was it easy and convenient? Certainly not, but I am very glad I put in the effort.

If you made it to the end of the post, thanks for reading! Let me know if I can help you with any of this or if you have tips for improvement. Also, big thanks to all the developers making all the FOSS apps I've mentioned.

eggy

Funny you mention this. This is basically what I was working on recently to be able to better support Home Assistant and Proton Mail push notifications: https://github.com/lone-cloud/prism Also using IMAP with a self-hosted protonmail-bridge.

You don't need a desktop for proton bridge. I set up https://github.com/shenxn/protonmail-bridge-docker instead.

Instead of UnifiedPush I currently have push notifications being sent to Signal groups for the sake of organization. I'm currently working on hooking it up to a push server, but it requires that I also build a custom UnifiedPush Android app for the optimal UX (better notification display, can support email "Mark as read" button, etc...)

willow262

eggy Thanks, I did not know about the docker image for PM bridge. I will have to check it out. I will check out Prism as well. Always good to learn what others are doing.

willow262

eggy

Instead of UnifiedPush I currently have push notifications being sent to Signal groups for the sake of organization. I'm currently working on hooking it up to a push server, but it requires that I also build a custom UnifiedPush Android app for the optimal UX (better notification display, can support email "Mark as read" button, etc...)

ntfy works pretty good for me there. I have a separate topic for each app with an icon for easily recognizing the app this topic is for. It also has pretty good click and action support, sadly with the lack of deep linking there is no way it can do the "mark as read" function.

I also use it for Home Assistant, Proxmox, Grafana, TrueNAS and everything else on my homelab. A total of 10 topics/apps so far.

eggy

willow262 fyi, I'm not done with prism yet. I decided to rewrite it in golang yesterday for better efficiency over bun ( I self host on a pi 3 with 1gb of RAM). I'll need to retest it and finish the android push app before it really shines. I'm currently running the previous "sup" version of it that I released as a docker image.

eggy

willow262 I don't like ntfy because its service is too niche. You'll stand out on a network level as very few people use it. Instead I'm working on a fork of Sunup android app which uses Mozilla's push service that's perfect for crowd blending due to its popularity.

willow262

eggy cool, I've been using Go as the primary language for backend services for some years now over two separate jobs. I quite like Go, so I fully support that :)

willow262

eggy

I don't like ntfy because its service is too niche. You'll stand out on a network level as very few people use it. Instead I'm working on a fork of Sunup android app which uses Mozilla's push service that's perfect for crowd blending due to its popularity.

I host my own instance of the ntfy server so most of the traffic is between my own servers and my phone. Only telegram directly posts notifications to my ntfy service.

eggy

willow262 to me that's the worst possible option as from a network level you're 1-of-1 user of your self hosted instance. I want to crowd blend for my push notifications (via Mozilla in this case) so that I don't stand out.

willow262

eggy interresting. I am curious about your take on that. I have direct encrypted http and websocket traffic going between my servers and phone. How, and what, useful information could be extracted from that?

schklom

Or just use a VPN on your phone and you're good? :P

eggy

schklom VPNs don't solve the crowd blending problem. Quite the opposite. By using a VPN you're advertising that you have something to hide by masking your traffic. Public VPN IPs are well known. VPNs cost money and introduce another party that you need to trust. I do admit that VPN use depends on your country's laws to snoop on you. Based on your threat model, it probably makes sense to use a VPN if you live in the US or UK.

de0u

willow262 I have direct encrypted http and websocket traffic going between my servers and phone. How, and what, useful information could be extracted from that?

In theory, timing analysis and packet-size analysis. The general term for acquiring information based on communication patterns rather than cracking encryption is "traffic analysis", of which the "Pentagon pizza theory" is a famous special case. Traffic analysis is one objection posed by some people to WhatsApp.

eggy

willow262 You still have to connect to it, don't you? Encryption doesn't obscure the IP address of your requests - only its content. Note that WebSockets have to be maintained with a keepalive request every 30-60 seconds from the client side. When you self-host you become the only person in the entire world that connects to that IP. To me that's a privacy + anonymity concern. With push services like push.services.mozilla.com, you make requests to a service that's used by hundreds of millions of devices.

willow262

de0u I am familiar with the Careless Whisper exploit for E2EE messaging apps and I understand that traffic analysis can gleam surprising amount of information. In order for that to be effective someone would have to be doing a MIM attack (at least have my traffic pass through their infrastructure) or send traffic to my devices and measure the response (which is the case in Careless Whisper). I am not saying it is impossible, the traffic would go over the public internet and it is entirely possible traffic is intercepted. I deem it fairly unlikely that would be happening though.

willow262

eggy sure I get that. It depends on your threat model I guess and how much you trust the networks you're on. My country has pretty strong privacy laws and the ISPs are pretty trustworthy. In fact, I work for the local ISP. The connection between my phone and servers should not be leaving the country and I find it unlikely that my traffic specifically is being intercepted by an actor with bad intentions. Interesting perspective though, thanks for sharing.

schklom

Yeah, you don't blend anymore, but no one can see what you're doing.

introduce another party that you need to trust

I'd say it shifts trust from one place to another that at least promises to not look at what you're doing (if it's a good provider).

If you're going to use anything rarely used like ntfy, a VPN is the only easy way of hiding it (that I know of).
Another way is to use something like a Cloudflare tunnel so that you're contacting a popular IP and can blend in, but that's a bit advanced and you'd be giving most data to Cloudflare instead.

eggy

schklom I agree, but as I mentioned above, the crowd blending way that I believe is currently the best is to rely on push.services.mozilla.com which is what Sunup (UP distributor app) does by default. The only real difference there is that it doesn't support some of the custom functionality that ntfy app/service gives you, which is why I'm working on rolling my own service/app that uses mozilla's service as a transport.

schklom

That's not a bad idea, though very few use firefox so the crowd you'd blend in might be small enough that you're the only one in it, no?

eggy

schklom Mozilla apps are relatively popular based on its downloads. I believe its push service should be widely used.

xxx

schklom though very few use firefox

It should be enough.