The Medium is the Message: How Secure Messaging Apps Leak Sensitive Data to Push Notification Services
Nikita Samarin, Alex Sanchez, Trinity Chung, Akshay Dan Bhavish, Juleemun, Conor Gilsenan, Nick Merrill, Joel Reardon, and Serge Egelman

TL;DR
This study reveals that many secure messaging apps inadvertently leak sensitive user data through push notifications via Firebase Cloud Messaging, highlighting privacy risks and the need for better security incentives.
Contribution
It provides an empirical analysis of privacy leaks in popular secure messaging apps' push notification payloads and discusses the economic factors influencing security practices.
Findings
11 apps leaked metadata such as user IDs and names
4 apps leaked actual message content
Current mitigation strategies are inconsistent and insufficient
Abstract
Like most modern software, secure messaging apps rely on third-party components to implement important app functionality. Although this practice reduces engineering costs, it also introduces the risk of inadvertent privacy breaches due to misconfiguration errors or incomplete documentation. Our research investigated secure messaging apps' usage of Google's Firebase Cloud Messaging (FCM) service to send push notifications to Android devices. We analyzed 21 popular secure messaging apps from the Google Play Store to determine what personal information these apps leak in the payload of push notifications sent via FCM. Of these apps, 11 leaked metadata, including user identifiers (10 apps), sender or recipient names (7 apps), and phone numbers (2 apps), while 4 apps leaked the actual message content. Furthermore, none of the data we observed being leaked to FCM was specifically disclosed in…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Code & Models
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsPrivacy, Security, and Data Protection
