#Android notifications make absolutely zero sense.
You'd think that your apps would just ask your device to regularly query (or keep open) a direct connection to services that might notify you: your e-mail provider, your Fedi server, your RSS feeds, whatever. If there's a notification, your ring tone goes off. Perfectly easy.
How it actually works is that all of your notifications, including their sensitive contents, have to go through a "push service"; aka a random company's computer. By default, Google; but the #degoogled crowd made it so you can use any server you want, like Mozilla ones or whatever.
That still means all my notifications first go to Mozilla's computers?? And everyone in the #FOSS space is somehow okay with it? This is so ridiculous.
Yeah let me pretend to be super into privacy by sending all of my private conversations, bank statements, appointments, calls, health data, or whatever else appears in my notifications, to a random-ass company.
Because we decided that electronic devices somehow lost the ability to display notifications without a middleman. Wtf? #unifiedPush
@kitten Still means the server knows exactly which user receives a notification for which app at what exact time from where, which makes it trivially easy to pinpoint who you're talking to or what you're doing, and can actually leak quite a lot of information if you think about notifications from smart home stuff, sensors, calendars, feed subscriptions and so on.
Like, silly example but, do I want a fascist government like the US to know that I'm receiving daily notifications from an app like "easy HRT tracker" once the camps really get going?
Besides, never assume storing encrypted data on a compromised computer is safe just because it's encrypted. We realistically do not know the capabilities of bad actors like the US government, secret services, shitty people etc. You can also not be expected to keep an eye out for every single potential CVE that might affect a server hosting your own damn notifications.
