in their minds, they should be able to buy a device and when they open it up, it should already come pre-installed with their granddaughter's name and contact ready to go through a mind reading technology that knows that knows who bought the device and knows who exactly they want to talk to and when.
seriously? they got duped by a random protonmail account? good grief, actual retards work for verizon.
this should highlight why you should always protect yourself from these soulless uncaring corporate gargantuans that have zero desire to protect your basic data.
use PO boxes, JMP.chat numbers, email aliases, etc. never give out info that can be used to screw you over.
this is a physical access attack. if they already have physical access they can do a million other things too. this is kind of not important to be fair.
I've thought about this for a long time. Nice to see it getting attention.
this is why I don't really appreciate Graphene's sandboxed google play services as much as I appreciate MicroG. MicroG allows you to control which GPS-compatible apps get registered to your random ID on google's servers.
It's also worth studying your individual apps and how exactly they handle google push notifications. I know that there are various configurations, some which allow Google to see the content of the notification and some which done. of course, regardless of that, metadata such as who it gets delivered to and when, is still there.
do a postal money order or something. anyway you're making this way over complicated. but you do you.