Messaging push notifications are a privacy attack surface, says Durov

Pavel Durov, the co-founder of the Telegram messaging application, said that push notifications create a persistent, critical vulnerability to user privacy, allowing data retrieval even after messages and messaging applications that allow push notification data storage have been deleted from a device.

Durov cited a recent report, originally published by 404 Media, that the United States Federal Bureau of Investigation (FBI) was able to retrieve deleted messages from a Signal user by accessing device notification logs on an Apple iPhone. Durov said on Friday:

“Turning off notification previews won’t make you safe if you use those applications, because you never know whether the people you message have done the same.”

Source: Pavel Durov

Cointelegraph reached out to Signal about the FBI’s data retrieval but did not receive a response by the time of publication.

The recent reports highlight how investigators and those with sufficient technical skills can circumvent end-to-end encryption and breach user privacy by accessing metadata and other information generated by applications, prompting a need for decentralized messaging applications that do not collect such data.

Related: Telegram founder Pavel Durov says Iranian government's ban backfired

Alternative messaging application use surges amid spikes in civil unrest and geopolitical turmoil

Decentralized messaging applications and social media platforms experienced a surge in user interest since 2025, amid geopolitical tensions, nationwide communication blackouts and civil unrest.

Online search interest in decentralized social media platforms has spiked by 145% over the last five years. Source: Exploding Topics

Bitchat, a decentralized peer-to-peer messaging application that uses Bluetooth mesh networks to relay information between mobile devices, allows users to circumvent the internet and centralized communication networks entirely.

More than 48,000 users in Nepal downloaded the Bitchat application amid a nationwide social media ban in September 2025.

Individuals are also finding ways to circumvent national firewalls and bans on privacy-preserving applications by using virtual private networks (VPNs) and other tools that mask or obscure IP addresses and geolocation, according to Durov.

Government bans on Telegram have backfired, as users circumvent state-imposed restrictions through VPNs, allowing them to access and download banned platforms, Durov said.

“The government hoped for mass adoption of its surveillance messaging apps, but got mass adoption of VPNs instead,” he continued, adding that over 50 million users in Iran have downloaded the Telegram application, despite a years-long government ban.

Magazine: EU’s privacy-killing Chat Control bill delayed — but fight isn’t over