In the backend, the SQLite database of Notification Center also keeps a copy of truncated messages, which can be accessed with normal user permissions, or by a malicious app installed on the system.

'Disappearing' messages may remain in the User Interface of macOS Notification Center even after being deleted within the Signal app and can be seen in the notification bar until manually closed by the user.

Now, sharing incoming disappearing messages with the notification system leads to two privacy issues:

Join our insightful webinar! Save My Seat! Var S = window.Sprig S.appId = a S._queue = window.UserLeap = S Ī.async = 1 a.src = e + '?id=' + S.Zero Trust + Deception: Learn How to Outsmart Attackers!ĭiscover how Deception can detect advanced threats, stop lateral movement, and enhance your Zero Trust strategy. I've just uploaded a simple python script that parses and dumps all notification records 😎Ģ) From the terminal (/Applications/Utilities/ Terminal.app) run:įor more information on all of this - including possible mitigations, read the full blog post: ' When Disappearing Messages Don't Disappear'Ħ00 Townsend Street, Suite 500 San Francisco, CA 94103 USA Phone: +1 (833) 972-8766 Want to see what's in your notification database? Yes, Signal's disappearing messages may end up in this database, even after they have 'disappeared': While this is not shocking news, it's problematic for applications that tout 'disappearing messages' - such as the popular secure messaging app Signal. On macOS, notifications (those 'alerts' that are shown in the upper top-right corner, when a new iMessage, Slack message, etc, is received), are saved to a system database. Tl dr 'disappearing' messages may still be stored on your Mac!īlog: ' When Disappearing Messages Don't Disappear'Īrticle: ' 'Disappearing' Signal Messages Stored Indefinitely on Hard Drives'

Disappearing messages signal