Apple Patches a Signal Leak - DTNS 5254  🔗 **Source:** [Apple Patches a Signal Leak - DTNS 5254](https://share.snipd.com/episode/db249aa6-fba4-47df-aaf2-6c393349923c) ## Highlights - **Apple Fixed Signal Notification Cache Leak** - Apple patched a notification caching bug that could retain Signal message previews after dismissal or app deletion. - 404 Media reported the FBI extracted cached Signal notifications lasting up to 30 days, prompting Signal's Meredith Whitaker to ask Apple to fix it and Apple to backport the patch to iOS 18. Transcript: Tom Merritt So yeah, Apple pushed a software update on Wednesday for iOS and iPadOS that fixed a bug where in Apple's patch notes words, notifications marked for deletion could be unexpectedly Retained on the device. Now think back all the way to April 9th, two weeks ago, when we told you about 404 Media reporting on the FBI successfully pulling notifications for signal messages out of the internal Notification storage cache. And according to 404, notifications in there could persist for up to 30 days after you deleted them, after you dismissed them. They should go away immediately, but they weren't. They were sticking around in cash. So the recommendation at the time that we gave and everybody was giving was if this is a problem for you, you want to set your signal notification to name only or no name or content. That might be something to just keep in mind as a safety precaution anyway, especially if you haven't pushed this software update yet. But basically what was going on was if you got a preview text of your signal message and notification, in other words, you got the notification and the text of what was sent to you was in The notification, even after you got rid of it, it stayed in the cache. Even if you deleted the message in Signal, in fact, even if you deleted the Signal app. So this was not something Apple intended. It was just getting stuck in cache and the cache wasn't getting cleared out. Signal president Meredith Whitaker asked Apple to address the issue. Apple has not commented beyond the patch notes, but did backport the fix to iOS 18. So everybody's pretty sure that this fix is because of that problem. And in fact, Meredith Whitaker has thanked Apple for patching it. So this is a, hey, good to know. And if you're concerned, you probably want to update your iOS really soon. ([Time 0:02:41](https://share.snipd.com/snip/e9714609-9078-4254-aa57-be53bde1b31e)) - **Change Signal Notifications Until You Update** - If you're concerned about message previews persisting, change Signal notifications to name only or no name until you update iOS. - The issue affected preview text in notifications and persisted even after deleting the Signal app, so updating iOS is the practical fix. Transcript: Tom Merritt They should go away immediately, but they weren't. They were sticking around in cash. So the recommendation at the time that we gave and everybody was giving was if this is a problem for you, you want to set your signal notification to name only or no name or content. That might be something to just keep in mind as a safety precaution anyway, especially if you haven't pushed this software update yet. But basically what was going on was if you got a preview text of your signal message and notification, in other words, you got the notification and the text of what was sent to you was in The notification, even after you got rid of it, it stayed in the cache. Even if you deleted the message in Signal, in fact, even if you deleted the Signal app. So this was not something Apple intended. It was just getting stuck in cache and the cache wasn't getting cleared out. Signal president Meredith Whitaker asked Apple to address the issue. Apple has not commented beyond the patch notes, but did backport the fix to iOS 18. So everybody's pretty sure that this fix is because of that problem. And in fact, Meredith Whitaker has thanked Apple for patching it. So this is a, hey, good to know. And if you're concerned, you probably want to update your iOS really soon. ([Time 0:03:21](https://share.snipd.com/snip/383e0e20-7c9e-404b-a2d0-2e079c40994d)) - **Treat Notifications As Lower Trust Surfaces** - Notification surfaces are OS-level features and can leak sensitive content if cached, so developers and users must treat notifications as lower-trust surfaces. - Huyen Tue Dao and Tom Merritt noted platform behavior drives what developers can control and users should avoid sensitive notification previews. Transcript: Huyen Tue Dao Yeah. Tom Merritt And I don't want to exaggerate the importance of this for the everyday person. You had to have physical access to the device. The case was the FBI had a person's phone. They had deleted signal in an attempt, I think, to cover their tracks. But the FBI was able to look at that notification database and go, oh, we found the evidence. We found the messages. I don't consider that the FBI was doing anything wrong there. They had a warrant for the device. The person was under investigation and all of that. But you don't want malicious people to be able to get that if they get a hold of your device, especially if you're in a sensitive situation. Maybe you're trying to be a whistleblower or you're dealing with an authoritarian government. Who knows, right? It's just, this is one of those things that, yeah, it doesn't impact all of us, but it's good to know. And like you said, it kind of makes you think about, oh, do I need to have the text of messages in my notifications? Maybe I do, but I should know that there are subtle risks to that. And the end of the story is, of course, that Apple patched it and it shouldn't be a problem. This should not be a problem going forward. ([Time 0:05:38](https://share.snipd.com/snip/635903b9-0de7-47d7-a1ff-75b7b3a70fce)) - **UK NCSC Endorses Passkeys Over Passwords** - The UK NCSC recommends passkeys as the default authentication, saying they are at least as secure and generally more secure than password plus two-step. - This is the first major government push to discourage passwords when passkeys are available, aiming to accelerate adoption and better implementations. Transcript: Huyen Tue Dao All right, well, the UK's National Cybersecurity Center, NCSC, released a technical report at its annual Cyber UK conference, concluding that PASCIs, quote, are at least as secure As and generally more secure than a password and two-step verification combo. It now officially recommends PASCIs as the default authentication standard, and that company should not also use passwords if, sorry, that company should not also use passwords If passkeys are available. Tom Merritt Yeah, this is significant because it's a government agency for the first time saying, actually, we're recommending passkeys. You probably shouldn't be using passwords. Passwords are less secure. Passwords with two-step verification or multi-factor authentication are at least as secure, but possibly also less secure. And I think that's a big step in getting companies to pay attention to this. I know that the implementation of PASCIs up until now is a mess. You and I have a good friend, let's just call him Ron, who is not a fan. Huyen Tue Dao Wildly hostile, yeah. Sorry, not a fan, wildly hostile, yeah. Tom Merritt You know, we'll protect his identity otherwise. But yeah, I think this is good. And I think it's the kind of thing that's needed to be able to say to companies who really are making a mess of the rollout. ([Time 0:10:35](https://share.snipd.com/snip/8d3cc78d-a7ed-4f8b-aed9-3e168ff26877)) - **Migration Is The Hard Part For Passkeys** - Implementation and migration strategies are the main barriers to passkey adoption, not the underlying cryptography. - Hosts discussed inconsistent company rollouts, user resistance, and the need for standardized migration best practices to avoid fallback to passwords. Transcript: Tom Merritt And eventually, I think we'll land in a place where everybody understands and they're implemented properly, but it's going to be rough getting there. So it's good to see a recommendation like this, in my opinion. Yeah. Huyen Tue Dao And I think that that was one of the things I definitely was stumping for PASCIs at first. And I think as an engineer, I tend to rely on the fact of explaining how the spec works and how much easier and secure this could be. But of course, then normal people like our good friend, like, let's say not like, I guess the average user or even even a slightly a techie user, don't really give a dime necessarily about How cool the underlying encryption like protocol is. And like, to be very fair, the actual implementation is very different. And actually, that was one thing that hit me is that I 100% agree with you that we need recommendations like this to just drive the point forward that, look, we are telling you that this Is more secure. You should be using these. But that, yes, the problem is that as secure in theory as an abstract protocol can be and as important as it is to have a government agency or other expert agency tell you how good it is, The actual human rollout can vary quite wildly. And that in a sense, like that could make or break it, obviously. And I will say that one thing that did come up a lot when we were, when I'm trying to stand for it, and our good friend Ron is expressing his opinion, is that, yeah, a lot of cases, companies, And I guess with empathy, companies do have a challenge, right? Because most people are using passwords. And I don't think there was a good generalized strategy for, okay, how do you take a company that's using two-factor pass keys? What is an optimal, optimally ergonomic and optimally secure way to migrate a, you know, a website, a service that is that has passed that has passwords and and two factor? What is a great strategy to migrate people slowly to pass keys? Because what a lot of companies have done is have both passwords and pass keys, which is honestly like it detracts from the passkeys because you can always back up the passwords. But for human beings, like say, not even necessarily us, but like my dad or other folks that are not techie, there's not a good on-ramp right now for passkeys. So understandably, part of the mess has been that there's no just generalized and maybe vetted strategy for that. So yes, agree. Tom Merritt That would be the one thing I might criticize Fido, the folks who put together Pasky's is there needed to be a standard for transitioning people. That's way easy for me to say sitting here in my little, you know, ivory soap tower. But, you know, that seems to be the one thing that's messing this up because when you get to a company that has finished implementing it, right. I deleted my password with Microsoft. I took, I did it live on DTNS one day. I have never run into a problem. Uh, once you get to the point where it's like, Oh, you're just using passkey. It's so much easier than dealing with passwords. It's so much easier than dealing with password managers. But most companies have not pushed themselves there and most users would resist it, which is why they haven't pushed themselves there. And so until we get to that world where everybody goes, oh yeah, this is a lot easier, you are going to have this mess of like, well, it's still actually vulnerable because you're still Backing it up with passwords. And there's one company that requires me to log in with my password then asks me for my passkey and i'm just like that's not no that doesn't there's no reason for that like what are you doing Huyen Tue Dao Um but yeah yeah okay um i guess it's one thing for people who are writing protocols very smart people i could never do that. The migration parts, the important part. So maybe like just as a request, maybe for the future. Thank you. Tom Merritt Or as we've learned this now, right? And this is why I think it's good that the UK has done this and said, you should not be using passwords if you're implementing passkeys and you should implement passkeys. Let's have some best practices circulating out there. I'm sure they're there. Let's make sure that more companies are aware of them and the companies can then go, oh, okay, that's what we've been mistaking. That's where the resistance and the messing up is coming from. ([Time 0:12:06](https://share.snipd.com/snip/15fb2ed5-bdde-4ae6-8ba7-39ff0a2a870e)) - **Thin Metasurface Display Switches Between 2D And 3D** - Researchers created a metasurface lenticular display that switches between 2D and glasses-free 3D by changing polarization and applying voltage. - The thin 1.2 mm lens demonstrated on a 5x5 cm OLED delivers a 100° viewing angle and can switch concave/convex to toggle 2D/3D. Transcript: Tom Merritt We got a really cool display technology coming out of researchers or scientists from Pohang University of Science and Technology orTech, and Samsung, publishing a paper in the journal Nature, describing a method of creating a display that you can switch between 2D and glasses-free 3D with just tapping a button. The color display is powered by a Meta Surface lenticular lens. You might have heard of lenticular lenses. Nintendo famously used it in the 3DS. It's the thing that gives you the, you know, you can see two different pictures on the little Cracker Jack things. But a metasurface and a lecticular lens are what's important here. And I'll read from the journal. It can switch focal behavior on the basis of the polarization of incident light. That's the light that's hitting it, right? Not the light it's generating. The display also has a viewing angle of 100 degrees. You have glasses-free 3D displays right now, but you have to sit right directly in front of them because they only can do a 15 degree field of view. So this is good in a lot of ways. It's thin. This MLL, this lenticular lens is 1.2 millimeters thick. They demonstrated it on a very small 5-centimeter by 5-centimeter OLED panel, and then were able to apply voltage to switch between 2D and 3D. The short version of all of this is you'll be able to press a button, and the metal lens goes from concave when it's powered to convex when it's not, and concave lets you see 2D.k vex lets You see 3d it just that little very thin lens that's where the meta material is important here uh doesn't thicken the display much but just change convex concave and you see 2d or 3d and You get that wide angle viewing as well there's also another team from postech that published research in that same issue of Nature describing a new Medellins production method so That you can produce these kinds of displays at 300 units per second at a cost that's less than about $5 per unit. Now, improvements are needed to reach industrial scale and to refine that viewing angle quality, even though it's there, it may not be as good as they would like it. ([Time 0:16:25](https://share.snipd.com/snip/8e6e695e-b132-425b-a91d-537afe7a9035)) - **CATL's Ultra Fast Charging LFP Battery** - CATL announced a new fast-charging LFP battery that can go from 10 to 98% as fast as six and a half minutes in best-case. - They reduced internal resistance to ~0.25 mΩ and improved thermal management to prevent overheating during extreme fast charging. Transcript: Huyen Tue Dao The race to kill range anxiety has officially shifted gears from how far to how fast. If you thought 10-minute charging was the holy grail, the industry just moved the goalposts. Bodhi Grimm from the Killawatt podcast tells us about a new fast-charging tech. Tom Merritt Bodhi Grimm, welcome back. Bodie Grimm Oh, thanks, Tom. I'm happy to be back. Tom Merritt Well, I am happy that you have brought us another example of fast charging. We've talked in the past about BYD's super fast charging that can get you almost to 100% as fast as filling up your tank with gasoline would do. Who else is doing this and what are they doing? Bodie Grimm Yesterday catl had their tech day and they they announced a bunch of stuff uh more energy dense batteries batteries for aircraft and all that was kind of interesting but the thing that I glommed on to was their new fast charging battery so how fast is it compared to the byd one so the by Blade II battery is capable of, some of the Blade II batteries, are capable of charging From like 10 to 97% in about nine minutes, which is fast. Tom Merritt Yeah, it's super fast. Bodie Grimm The CATL, and I'll probably pronounce the name of the battery wrong, it's like Xinjing, Z-I It is, it can from 10 to 98%. Notice that 1% extra from about six and a half minutes. Wow. Tom Merritt Okay. I mean, honestly, once you get below 10 minutes, it's not that much of a change in my life, I guess, but that's still two and a half minutes faster. ([Time 0:26:53](https://share.snipd.com/snip/b6a47ad6-b420-46ab-856c-727bb2e4fc3e)) - **Wait For Charger Infrastructure Before Choosing Fast Charge Cars** - Don't buy a car just for ultra-fast charging until infrastructure exists on your routes. - Bodie Grimm warned that cars need compatible chargers (up to ~1.5 MW) and local infrastructure must be available to use the speed. Transcript: Bodie Grimm There's a lot of stuff that goes on with battery chemistry. They're using LFP batteries, which we've talked about before, more robust. Tom Merritt That's lithium phosphate, right? Bodie Grimm Oh, yes. Lithium iron phosphate. Yes. I make the mistake all the time. Thank you. The other thing that they're doing is they have an, they slashed now this, and this is the internal resistance. I am not a battery engineer, so I'm just going to repeat this as it's written. They slash the, their milli ohms to just 0.25, which for the normal person, that's not important. What's important is it doesn't heat up the battery. And heat and batteries are a bad combination. So they're able through a bunch of battery management systems, battery chemistries, and then just general overall, the way that they structure their battery packs, they're able To reduce the heat down so it can cram a lot of energy in without overheating the battery. Tom Merritt And I assume that that is a huge thing for safety, right? Is that you want to stay away from overheating that battery. ([Time 0:28:54](https://share.snipd.com/snip/a9ae2a46-d289-4ff5-aaf6-ecbab04355e5)) - **Pulsed Heating Speeds Battery Warmup For Fast Charging** - CATL uses pulsed weak electrical coupling between motor and battery to warm packs faster for charging readiness. - That pulsed approach heats batteries two thirds faster than conventional methods, enabling near-instant fast charging even in cold conditions. Transcript: Bodie Grimm First, the battery warming, the pulse technology, they did something really cool here. In order for them to warm up the battery, they create like a, it's not a short circuit, but like a weak connection between the electric motor and the battery management system. And that heats up the battery because of this weak connection. Oh, interesting. Yeah. So, and it pulses. So it's not a consistent weak connection. It's a pulse. So it actually heats the battery up two thirds faster than the conventional approach, which is just, you know, basically like heating, not your car up, but like heating a surface up. Right. Yeah. And then the other thing here that I think is being missed a little bit when I hear people talking about this is yes, you can charge from 10 to 97% or 98% in six and a half minutes. And that's great. But if you just need a little bump and not that kind of bump, but like a little bump of energy, also not that kind of bump of energy, but if you just needed something to get you, you just have A little bit longer to go. You can go from 10% to 35% in a minute. Oh, wow. You can go from 10% to 80%, which is where most people live their charging realm in three minutes and 44 seconds. So if you're in a rush and you have ([Time 0:35:00](https://share.snipd.com/snip/c7d55a0d-812b-48fe-bc31-942e29881013)) - **Using Whisperian To Dictate Tailored Messages** - Brandon from Goa uses Whisperian to create ~40 custom prompts that convert his speech into polished emails and WhatsApp messages for his yoga retreat center. - He highlighted voice-driven text injection to ChatGPT and Gemini and tested Google's Edge Elegant on iPhone for similar features. Transcript: Tom Merritt Yeah. Brandon writes, good morning from Goa, India. I used to use Gboard and root my phones with custom ROMs, but after loads of hunting, I've come across an app called Whisperian out of Croatia. I run a yoga retreat center here and communicate with so many people on email and WhatsApp day to day. I have about 40 custom prompts on this app, dialing in every detail. I want the output to be like text replacements, profile-specific prompts, and I have it now where I can speak and it outputs exactly how I want automatically. It really is like magic happening. I'm able to communicate with my voice to ChatGPT or Google Gemini or anyone via speech-to basically my mind outputting onto the text field and I can do it so easy. Recently, Google launched, I think it's called Edge Elegant for the iPhone. I tested it the other day. It's just a standalone app and it doesn't actually inject text yet, but it is pretty cool. You can see they're possibly trying to ramp up where this is going in the future. Anyway, I'm super excited about it. Love your show. It's nerdy and wonderful. And I thought I would share this with you. Have a great day. Take care, Brandon. ([Time 0:38:24](https://share.snipd.com/snip/9a71fd88-0029-41dc-9637-53cb228b2705))