The Medium is the Message: How Secure Messaging Apps Leak Sensitive Data to Push Notification Services
Authors: Nikita Samarin (University of California, Berkeley and International Computer Science Institute (ICSI)), Alex Sanchez (University of California, Berkeley), Trinity Chung (University of California, Berkeley), Akshay Dan Bhavish Juleemun (University of California, Berkeley), Conor Gilsenan (University of California, Berkeley), Nick Merrill (University of California, Berkeley), Joel Reardon (University of Calgary), Serge Egelman (University of California, Berkeley and International Computer Science Institute (ICSI))
Volume: 2024
Issue: 4
Pages: 967–982
DOI: https://doi.org/10.56553/popets-2024-0151
Abstract: Like most modern software, secure messaging apps rely on thirdparty components to implement important app functionality. Although this practice reduces engineering costs, it also introduces the risk of inadvertent privacy breaches due to misconfiguration errors or incomplete documentation. Our research investigated secure messaging apps' usage of Google's Firebase Cloud Messaging (FCM) service to send push notifications to Android devices. We analyzed 21 popular secure messaging apps from the Google Play Store to determine what personal information these apps leak in the payload of push notifications sent via FCM. Of these apps, 11 leaked metadata, including user identifiers (10 apps), sender or recipient names (7 apps), and phone numbers (2 apps), while 4 apps leaked the actual message content. Furthermore, none of the data we observed being leaked to FCM was specifically disclosed in those apps' privacy disclosures. We also found several apps employing strategies to mitigate this privacy leakage to FCM, with varying levels of success. Of the strategies we identified, none appeared to be common, shared, or well-supported. We argue that this is fundamentally an economics problem: incentives need to be correctly aligned to motivate platforms and SDK providers to make their systems secure and private by default.
Keywords: privacy, security, mobile, push, notifications, FCM
Copyright in PoPETs articles are held by their authors. This article is published under a Creative Commons Attribution 4.0 license.
