Update: notifications are now in the iPhone and Android apps too, from version 1.4.1. Turn them on in the app under Account → Notifications.
HushOS can now tell you when something happens in your account, even while it's closed: a new sign-in, a device removed, something shared with you, an invitation to a family. Turn it on for a browser under Account → Notifications → On this browser.
What makes this different is what the notification carries on its way to you: nothing about what happened.
What you'll be told
- Security notices, always: a new sign-in, a device removed, or someone repeatedly trying to confirm your password. These still come by email too.
- Shared with you and Families: when someone shares something with you, invites you to a family, or is waiting to join yours. You can turn either off.
How a notification stays private
A notification has to pass through your browser's push service on the way: Google's for Chrome, Mozilla's for Firefox, Apple's for Safari, Microsoft's for Edge. The web's push standard already encrypts each message to your browser, so they can't read it. HushOS goes further and puts nothing in the message worth reading:
- When something happens, our server sends your browser a random event ID, encrypted so only that browser can open it. Nothing else.
- Your browser wakes HushOS, which fetches that event from our server over your own signed-in connection.
- HushOS writes the notification on your computer, from what only your account can read.
So the push service sees that your browser got a small encrypted message, and when, and even inside it there is nothing about what happened. That matters most on phones, where Apple and Google can read what an app sends.
If no HushOS tab is open and unlocked, there is nothing on your computer that can read the event, so you see a plain New activity in HushOS. Open HushOS to see what it was.
When someone shares something with you, the notification names them only if you've checked them as a contact yourself. Anyone else shows as Someone, so a stranger can't put words of their choosing on your screen by picking a misleading name.
On your phone
The iPhone and Android apps get notifications the same way, through a small service of ours at push.hushos.com. Apple and Google only deliver to an app from its publisher, so that service hands them a random event ID and nothing about what happened, and the app writes the notification on the phone. The page at push.hushos.com says exactly what it keeps and what Apple and Google can see.
On iPhone and iPad, Safari shows notifications only for a site added to the Home Screen, so the app is the better way there.
Running your own server?
Notifications are off by default on a self-hosted server. Set NOTIFICATIONS_ENABLED=true to turn them on. Browsers need nothing else: your server sends to them directly, through the browser's own push service. Phones signed in to your server are reached through push.hushos.com, unless you set PUSH_RELAY_URL to an empty value. The self-hosting guide has the details.