macOS Notification Center retains Signal messages
Signal's macOS app leaves 'disappearing' message contents recoverable in the macOS Notification Center database even after they're deleted from the app's UI.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
- Date
- The source gives no publication date; the date shown is the day Vorant added the brief.
Security researcher Patrick Wardle investigated a bug reported by Alec Muffett showing that Signal's macOS desktop application fails to properly clear message content from the OS-level Notification Center database when disappearing messages expire. The root cause is that Signal posts notifications containing full message text (and even image attachments) to macOS's Notification Center, but never explicitly deletes these entries when it removes the corresponding messages from its own UI. The OS auto-dismisses the visible banner alert after a few seconds, but the underlying SQLite database record (stored at ~/Library/.../com.apple.notificationcenter/db2/db) persists indefinitely and is readable with normal user permissions.
Wardle demonstrated that these notification records — including binary property list blobs containing sender name, message body, and even embedded images — can be trivially extracted and decoded using Python's biplist module, effectively allowing recovery of 'deleted' or 'disappeared' Signal messages long after they should have been erased. This represents a privacy/information-disclosure issue rather than a remote exploit: any local user or process with read access to the filesystem could recover sensitive message content that users believed had been permanently removed.
The issue appears specific to the macOS desktop client; the iOS version was not found to exhibit the same behavior. Mitigations suggested include disabling notifications within Signal's settings or manually deleting the notification database, though the article notes uncertainty about whether removing entries truly purges message content from the underlying store.
Source reporting: https://objective-see.org/blog/blog_0x2E.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs