Privacy · in depth
Extra privacy tricks
Your messages are already end-to-end encrypted: only the person you write to can read them. These four tricks make it harder to learn anything else from the outside — how long a message is, when you sent it, whether you’re writing at all.
To the Lofts, all three look the same. Always on
1 Same-size messages
Before a message is encrypted, it’s filled up to one of a few fixed sizes. To the Lofts that carry it, “ok” and a long paragraph look the same.
- Helps against
- Guessing what a message is from its size — a quick yes, a long story, a link.
- Doesn’t help against
- Photos and files still show roughly how big they are. Padding for them comes later, once most phones can read it.
Always on. Nothing to set.
Saved at once. Sent a moment later. On by default
2 Delay sends slightly
When you press Send, the message is encrypted and saved on your phone at once, then leaves after a random half second to two seconds. If you close the app meanwhile, it still goes the next time CarrierMSG connects.
- Helps against
- Matching the moment you press Send with the moment a message reaches a Loft, or another phone lights up.
- Doesn’t help against
- Someone watching both your connection and the other person’s for a long time. Calls, typing and read receipts are never delayed.
On by default. You can turn it off in You › Privacy & safety › Extra privacy tricks.
Real and dummy messages look the same on the way. Optional · off by default
3 Cover traffic
While CarrierMSG is open, your phone can now and then send a dummy message that looks like a real one on the network: the same size, the same address, real encryption. It’s addressed to you, and your Loft throws it away unread. Nobody is notified.
- Helps against
- Someone watching your Wi-Fi or internet connection telling when you really write.
- Doesn’t help against
- It doesn’t hide that you use CarrierMSG, and your own Loft can tell these are dummies.
Optional, off by default. Only while the app is open on screen, on Wi-Fi unless you allow mobile data, never in battery saver. About 0.3 MB a month for an hour a day; never more than about 4 MB.
Phones in between carry it. They can’t read it. Preview · off by default
4 Messages with no internet at all
With no internet, phones that have the offline mesh switched on can pass your encrypted message from one to the next over Bluetooth and Wi-Fi until it reaches your friend. The phones in between can’t read it.
- Helps against
- Being cut off when the internet is down nearby, for people you’ve already chatted with or met.
- Limits
- It’s a preview — the app must be open on every phone, every phone needs the latest version, and it hasn’t been tested between real phones yet. Nearby phones can tell a mesh phone is around.
Preview, off by default.
Planned Planned: padding for photos and files (a later update)
These add to end-to-end encryption; they never replace it. They’re open source (AGPL-3.0) like the rest of CarrierMSG.
Questions
Does this replace end-to-end encryption?
No. Every message is still encrypted with the Signal Protocol so only the recipient can read it. These tricks hide extra things around the message: its size and its timing.
Will delayed sends make my messages slow?
At most two seconds, and only for messages you write. Calls, typing, read receipts and everything else go at once. You can turn it off.
Can my Loft see cover traffic?
Yes. Your home Loft knows the dummies are addressed to you and throws them away. Cover traffic is for people watching your connection, not for hiding from your own Loft. If you want to hide more from the Lofts too, see “How CarrierMSG hides who and where”.
Does cover traffic use my data or battery?
A little: about 0.3 MB a month if the app is open an hour a day, never more than about 4 MB a month. It only runs while the app is open on screen, on Wi-Fi unless you allow mobile data, and never in battery saver / Low Power Mode.
Are photos padded?
Not yet. Phones from before this update would refuse a padded photo, so padding for photos and files is switched on in a later update, once most phones have this one.
Does the offline mesh work with no internet anywhere?
It’s a preview. It can carry messages between nearby phones that all have it switched on and the app open, for people you’ve already chatted with or met. It hasn’t been tested between real phones yet, so don’t rely on it.
Is it open source?
The apps, the relay and the Lofts are AGPL-3.0 licensed. Both apps follow the same padding rules, tested against shared test vectors.