The Medium is the Message: How Secure Messaging Apps Leak Sensitive Data to Push Notification Services

TL;DR

This study reveals that many secure messaging apps inadvertently leak sensitive user data through push notifications via Firebase Cloud Messaging, highlighting privacy risks and the need for better security incentives.

Contribution

It provides an empirical analysis of privacy leaks in popular secure messaging apps' push notification payloads and discusses the economic factors influencing security practices.

Findings

11 apps leaked metadata such as user IDs and names

4 apps leaked actual message content

Current mitigation strategies are inconsistent and insufficient

Abstract

Like most modern software, secure messaging apps rely on third-party components to implement important app functionality. Although this practice reduces engineering costs, it also introduces the risk of inadvertent privacy breaches due to misconfiguration errors or incomplete documentation. Our research investigated secure messaging apps' usage of Google's Firebase Cloud Messaging (FCM) service to send push notifications to Android devices. We analyzed 21 popular secure messaging apps from the Google Play Store to determine what personal information these apps leak in the payload of push notifications sent via FCM. Of these apps, 11 leaked metadata, including user identifiers (10 apps), sender or recipient names (7 apps), and phone numbers (2 apps), while 4 apps leaked the actual message content. Furthermore, none of the data we observed being leaked to FCM was specifically disclosed in those apps' privacy disclosures. We also found several apps employing strategies to mitigate this privacy leakage to FCM, with varying levels of success. Of the strategies we identified, none appeared to be common, shared, or well-supported. We argue that this is fundamentally an economics problem: incentives need to be correctly aligned to motivate platforms and SDK providers to make their systems secure and private by default.