Durov Warns Push Notifications Create Critical Privacy Vulnerabilities

Pavel Durov, co-founder of the Telegram messaging app, has identified push notifications as a critical security flaw in modern communication platforms. According to Durov, these notifications create a persistent 'attack surface' that allows sensitive data to be retrieved from a device even after the messages and the applications themselves have been deleted. The warning follows reports that the U.S. Federal Bureau of Investigation (FBI) successfully recovered deleted messages from a Signal user by accessing notification logs on an Apple iPhone. This highlight suggests that while end-to-end encryption secures the transmission of data, the metadata and content snippets stored by the device's operating system for notifications remain vulnerable to forensic retrieval. In response to these vulnerabilities, Durov is calling for a shift toward decentralized messaging applications that do not collect such metadata. He cited the rise of peer-to-peer tools like Bitchat, which utilizes Bluetooth mesh networks to relay information without relying on centralized internet infrastructure. In Nepal, Bitchat saw over 48,000 downloads during a nationwide social media ban in September 2025. Furthermore, Durov noted that state-imposed restrictions on privacy-preserving apps often result in the mass adoption of circumvention tools. In Iran, despite a years-long government ban, over 50 million users have downloaded Telegram by utilizing Virtual Private Networks (VPNs) to mask their IP addresses and geolocation, effectively undermining state surveillance efforts.