RRZishe Does graphene have a plan of providing an alternative to Google for push messages? Because I sadly need to use Google for push notifications and it really bothers me.
As previously mentioned, there are a few alternatives already available. You have the unified push which was already mentioned, as well as conversations/jabber & NTFY
I sent couple of emails to Proton developers requesting to implement web socket for the apk available on their website but they don't even bother. So, I switched to Tutanota.
And they took these steps in 2020 (right when requested in pm uservoice, which till now they didn't do anything)
https://tuta.com/blog/open-source-email-fdroid
Again a good marketing strategy by Tuta against PM.
My workaround until Proton implements its alternative push notification framework:
Profile 1: Owner Profile, Sandboxed Google Play installed
Profile 2: daily driver, degoogled
So that I am notified of incoming emails in Profile 2 (pull instead of push strategy is unfortunately not an option for professional reasons), I have also installed the Protonmail app in Profile 1.
Via "sent notifications to current user" I am immediately informed in Profile 2 about the receipt of an email and can then open Protonmail in the de-googled profile and read / reply to the email without switching profiles.
Not a very sexy workaround, but it works for me (especially because the owner profile is always active anyway).
Murcielago with this approach you are just hiding from the fact that you use Firebase for notifications albeit in an indirect way (by thinking that two different users can not be linked by other personally identifiable activity, network connection or tracking and fingerprinting).
Good point, thanks for clarifying. I didn't mean to say that activities of two user profiles cannot be linked by other measures - I am aware of that problem.
That's why it's just a suggestion of a workaround that might offer the original questioner an idea until Proton implements alternative push notification, if he
foxjaw Proton is already susceptible to Apple/Google Push notification theft, since they also reveal the mail titles as well as the sender mail, which is very insecure tbh.
This is incorrect. Please double check your statements before posting.
For Apple users, on each login, the app generates an asymmetric keypair, saves the private key on Keychain, and sends the public key to Proton’s push notification server accompanied by the user’s session ID. This server encrypts every push notification with the public key, and the application extension decrypts it using the private key from Keychain, ensuring that Apple (or an intelligence agency sitting on Apple’s servers) does not have access to the contents of push notifications. Raw push notifications are not persisted on the device for long and are not included in backup. The private key is removed from Keychain on logout, and the public key is not reused across sessions.
https://proton.me/blog/ios-security-model
For Android users, Proton Mail’s push notification servers always encrypt the notifications they send, and the Proton Mail client decrypts these notifications locally. These notifications are never stored on the device.
https://proton.me/blog/android-client-security-model
If need be, an individual could always simply turn off their device's notifications on the lock screen to be more private. That way, someone who picks up their phone won’t be able to see the individual's contacts, message previews, reminders and alerts.
@ErnestThornhill It's not about encryption. It's about readability. ProtonMail still relies on Google Services Framework to deliver push notifications. Whether encrypted or not doesn't matter, as long as the underlying service controlled by Google themselves.
Whatever you see in the notification, Google sees that too.
And beware that proton can write anything in their blog. As long as they don't back it up, we're never sure. Their backend is closed source.
foxjaw And beware that proton can write anything in their blog. As long as they don't back it up, we're never sure. Their backend is closed source.
That doesn't really mean anything. The same could be said about any website.
What's your source for your last sentence?
de0u Beware that anyone can write anything anywhere at anytime. As long as they don't back it up, we're never sure.
Whether encrypted or not doesn't matter, as long as the underlying service controlled by Google themselves.
Whatever you see in the notification, Google sees that too.
Is that the case? Proton says that their "notification servers always encrypt the notifications they send, and the Proton Mail client decrypts these notifications locally."
Would be interesting to know what exactly Google sees of this...
Murcielago Beware that proton can write anything in their blog. As long as they don't back it up, we're never sure.
Notification theft by google & apple might be claims. But not just this, there are a lot more reasons we're trying to move away from them. The whole concept of "We provide privacy with atmost care" is not to be believed, the only reason being they're not FOSS. Notifications are never encrypted on both Android & Google. On top of that utilizing GSF for push notifications is another red flag. I can't give any more reasons than these.
foxjaw A personal opinion is as reliable of a source as Wikipedia. There's a reason why Wikipedia is not an approved source for information when writing a paper for school...
You don't have to take their word - check the GitHub: https://github.com/ProtonMail/proton-mail-android
Phead I'm aware. I was (jokingly) quoting foxjaw in that response.
ErnestThornhill
Apologies, didn't get that.
whew-zee Your concerns, along with the post from akc3n have convinced me to ditch the proton mail app and use Vanadium to access my proton and other mail accounts. So far so good - I realize that I do not get mail urgent enough to require notifications from the mail servers.
Somewhere on this P7P there should be a list of accounts which are known to Firebase Cloud Messaging (FCM which I think is the evil mentioned in
Can anyone point me to where I can delete any FCM linkage to PMail and others? Possibly I need to deactivate it in google services in the main account!?
foxjaw Whatever you see in the notification, Google sees that too.
foxjaw Notifications are never encrypted on both Android & Google.
Both of these statements are not really true.
(Just a note, I don't know about Apple's APN, so I won't comment on that)
FCM is a push messaging service, not a push notification service. When a message / "notification" comes in, the app is woken up and can process the notification and display something. Many apps/services send messages with empty data fields, like Signal. Apps/services can also elect to encrypt data in the data field. It all depends on their implementation.
Given that, an FCM message without extra personal data included will only allow Google to see very basic info, like time and which service is sending the message and to who.
But of course there's the flip side to this. Lazy app developers can just shove a bunch of plain text data into notification messages.
As for whether the apps/services in question really send personal info via plaintext in FCM messages, I really don't know, but I seriously doubt it. I'd suggest you read through the code in their apps that process notifications to know for sure.
I suggest you read through this page: https://firebase.google.com/docs/cloud-messaging/concept-options
