Hacker News Reader

Comment by uncheckederror | Hacker News Reader

Nice to see Signal (not the default Messages app) in the Smart Reply demo.

Is it?

I use Signal because I don't want Google reading my messages.

As it was in Gmail and Messages, 'Smart Reply' is done with on-device models, messages aren't sent to Google. Source: https://9to5google.com/2019/04/05/ml-kit-smart-reply/

And?

I don't want Google reading my Signal messages on their devices or mine.

Your OS is 'reading' your messages (whether you use smart reply or not)

If you use the build in keyboard they can read your messages.

Yep. Just like spellcheck in Chrome that will communicate contents to Google servers, unless you opt out.

Proof, or just another wild claim? You can not only disable Internet access to GBoard, but you can completely use it without Google Play Services.

Does Smart Reply send your messages to Google?

No, it uses the app's API to do that. However, the push notification from GCM does come from google and is possibly read though.

Signal dev here. Just wanted to make it clear that the GCM/FCM we send are completely empty. It just wakes up the app so we can fetch the encrypted messages, at which point we decrypt them and show them to the user.

Thank you for clarifying. Didn't know you could do that! Then again, I haven't played around with Android developing in a few API versions.

Could you please explain what's happening here then, in terms of how Google is reading our Signal messages to provide "smart" replies?

Smart replies are provided on the OS side after notification is generated using on-device ML model.

They show up on all apps that provide messaging.

This does ultimately mean Google is intercepting and reading them then (albeit on the device).

IIRC Signal doesn't send message contents over GCM because of that - it just sends a ping that wakes the app to retrieve the data.

(The app of course also has a choice of encrypting the payload - it's free form after all.)

I believe there is an API for hooking into notification text prior to display, which allows the Signal app to decrypt the message. The Signal server doesn't have access to the plaintext message in order to send it in a GCM.

Push notification from GCM should not contain any user data. It should be treated just like a notification to the app to check its event source and then display user notification with data sourced from there.

thats not a reliable assumption.

push notifications services can merely send instructions, and the visual notification can be an object formed completely client side.

It really doesn't need to if the messages are coming from Google, right?

so turn it off?

Looks like they are starting to get seriously concerned about projecting non-monoplistic "fair competition" image. Unfortunately most devs know it's not the case in reality.

Unfortunately?

The devs know, that it's unfortunately not the truth, that they want to be non-monopolistic.

First thing I noticed too. That's awesome.

Interesting indeed considering it has E2E encryption and RCS does not.

Reply on news.ycombinator.com