Signal messages retrieved from iOS notification

404 Media – 9 Apr 26

FBI Extracts Suspect’s Deleted Signal Messages Saved in iPhone Notification...

The case was the first time authorities charged people for alleged “Antifa” activities after President Trump designated the umbrella term a terrorist organization.

Archive link (No Paywall).

TL;DR:

The FBI was able to forensically extract copies of incoming Signal messages from a defendant’s iPhone, even after the app was deleted, because copies of the content were saved in the device’s push notification database […]

@henry-fisher from Techlore also provided some useful contextualization on his socials:

Mastodon BlueSky Twitter

When Signal messages arrive, iOS stores push notification previews locally on the device. Those previews stayed behind even after Signal was uninstalled.

Two things:

• Only incoming messages were captured this way
• Disappearing messages that had already vanished inside Signal were still recoverable from the notification cache

This is iOS behavior, not a Signal vulnerability. And likely impacts other apps.

This is a very high threat model concern, though the fix is straightforward: Signal → Settings → Notifications → Show → set to “No Name or Content”

You’ll still get a notification ping, but iOS just won’t cache anything useful.