Push Notifications Expose Privacy Risks, Durov Warns on Telegram & Signal

Pavel Durov, co-founder of Telegram, said “push notifications” are a persistent privacy attack surface that can allow message data retrieval even after users delete messages or remove the app. Durov cited a recent 404 Media report alleging the FBI obtained deleted Signal messages from an iPhone by accessing device push notification logs. Durov argued that end-to-end encryption can be undermined through metadata and other information generated by apps. He added that turning off notification previews would not fully protect users, because contacts may still generate loggable notification data. The report also highlights how investigators or skilled actors may bypass encryption by exploiting notification artifacts on devices. Cointelegraph said it reached out to Signal for comment but did not receive a response by publication. Separately, Durov pointed to rising interest in decentralized messaging as privacy and surveillance concerns grow amid geopolitical pressure, including communication blackouts and bans. He referenced Bitchat, a decentralized Bluetooth-mesh messaging app, and claimed more than 48,000 users in Nepal downloaded it during a nationwide social media ban in September 2025. Durov also said users have commonly relied on VPNs and IP/geolocation masking to circumvent bans, noting that Telegram reportedly reached over 50 million users in Iran despite a multi-year ban. For traders, the key takeaway is that privacy and censorship-resistance narratives may strengthen (decentralized messaging demand), but heightened surveillance risk can increase policy and compliance focus around major platforms and their ecosystems.