Hacker News Reader

Comment by headmelted | Hacker News Reader

Is it?

I use Signal because I don't want Google reading my messages.

As it was in Gmail and Messages, 'Smart Reply' is done with on-device models, messages aren't sent to Google. Source: https://9to5google.com/2019/04/05/ml-kit-smart-reply/

And?

I don't want Google reading my Signal messages on their devices or mine.

Your OS is 'reading' your messages (whether you use smart reply or not)

If you use the build in keyboard they can read your messages.

Yep. Just like spellcheck in Chrome that will communicate contents to Google servers, unless you opt out.

Proof, or just another wild claim? You can not only disable Internet access to GBoard, but you can completely use it without Google Play Services.

Does Smart Reply send your messages to Google?

No, it uses the app's API to do that. However, the push notification from GCM does come from google and is possibly read though.

IIRC Signal doesn't send message contents over GCM because of that - it just sends a ping that wakes the app to retrieve the data.

(The app of course also has a choice of encrypting the payload - it's free form after all.)

I believe there is an API for hooking into notification text prior to display, which allows the Signal app to decrypt the message. The Signal server doesn't have access to the plaintext message in order to send it in a GCM.

thats not a reliable assumption.

push notifications services can merely send instructions, and the visual notification can be an object formed completely client side.

Signal dev here. Just wanted to make it clear that the GCM/FCM we send are completely empty. It just wakes up the app so we can fetch the encrypted messages, at which point we decrypt them and show them to the user.

Could you please explain what's happening here then, in terms of how Google is reading our Signal messages to provide "smart" replies?

Smart replies are provided on the OS side after notification is generated using on-device ML model.

They show up on all apps that provide messaging.

This does ultimately mean Google is intercepting and reading them then (albeit on the device).

Thank you for clarifying. Didn't know you could do that! Then again, I haven't played around with Android developing in a few API versions.

Push notification from GCM should not contain any user data. It should be treated just like a notification to the app to check its event source and then display user notification with data sourced from there.

It really doesn't need to if the messages are coming from Google, right?

so turn it off?

Reply on news.ycombinator.com