Metadata: what your messenger knows about you
Encryption protects what you write. Metadata reveals who you talk to. Why that is often the more valuable part.
There is a line that has been circulating in security circles for years: "We kill people based on metadata." It comes from a former NSA director. You do not have to find that dramatic, but it captures how serious this is. Metadata is not the harmless leftover, it is often the most valuable part.
What metadata actually is
The content of your message is what you write. Metadata is everything else: who sends it, to whom, when, how long it is, how often you write, who else is in the group, from which IP address. Encryption protects the content. Metadata sits next to it, usually in plaintext.
Why it reveals so much
Metadata needs no content to tell a story. One example that always stays with me:
Someone messages a number belonging to an HIV counselling service late at night. Two days later, a laboratory. Then the same person four times in one week, never otherwise. You know nothing about the content, and yet you know everything.
That is the point. Networks of relationships, timings and frequencies form a profile that is often more revealing than the text itself. And unlike text, it lends itself beautifully to automated analysis.
What a typical messenger server stores
At almost every service the database holds a row like: message 4711, from Anna, to Ben, at 22:14, encrypted content. The content is safe. The rest of that row is a complete social network, sortable by time.
What PriChat does about it
We started exactly at that row. Four edges where metadata arises are closed at PriChat:
- Messages: the sender is not stored in plaintext. When fetching, your device tries which messages it can decrypt (trial decryption). The server therefore does not know who a message is from.
- Friend requests: sealed. The server cannot see who is asking whom.
- Groups: members are stored only as cryptographic pseudonyms (HMAC tags), not by name.
- Presence: waking a contact does not reveal the relationship either.
The result: our central database holds no plaintext record of who communicates with whom. Not because we delete it, but because it never comes into being.
Staying honest: what remains
Complete metadata freedom does not exist, and anyone claiming otherwise is selling you something. What we do see:
- Your IP address, when you connect (like any server on the internet). If you do not want that, use a VPN or Tor.
- Connection timings are visible, even if the relationship behind them is not.
- An adversary observing global network traffic can still correlate. No messenger in the world protects against that.
The goal is not perfection but frugality: what is never stored cannot be seized, leaked or sold.