  Like most modern software, secure messaging apps rely on third-party
components to implement important app functionality. Although this practice
reduces engineering costs, it also introduces the risk of inadvertent privacy
breaches due to misconfiguration errors or incomplete documentation. Our
research investigated secure messaging apps' usage of Google's Firebase Cloud
Messaging (FCM) service to send push notifications to Android devices. We
analyzed 21 popular secure messaging apps from the Google Play Store to
determine what personal information these apps leak in the payload of push
notifications sent via FCM. Of these apps, 11 leaked metadata, including user
identifiers (10 apps), sender or recipient names (7 apps), and phone numbers (2
apps), while 4 apps leaked the actual message content. Furthermore, none of the
data we observed being leaked to FCM was specifically disclosed in those apps'
privacy disclosures. We also found several apps employing strategies to
mitigate this privacy leakage to FCM, with varying levels of success. Of the
strategies we identified, none appeared to be common, shared, or
well-supported. We argue that this is fundamentally an economics problem:
incentives need to be correctly aligned to motivate platforms and SDK providers
to make their systems secure and private by default.
