Metadata Privacy

End-to-end encryption hides MESSAGE content. It usually doesn't hide:

• Who you talk to.
• When.
• How often.
• From where (IP).
• Message size patterns.

This is metadata — and it's sometimes more revealing than content. ("She called the abortion clinic at 3am" needs no message body.)

Signal's metadata-mitigation features:

• Sealed Sender (2018): server can't see who the sender is for most messages. Sender attaches an encrypted-to-recipient envelope. Server only sees recipient.
• Private Contact Discovery: server runs in SGX (Intel hardware enclave); user uploads encrypted phone hashes; server computes intersection without seeing them.
• Group anonymity (in progress): server doesn't see which group a message goes to.

Things Signal still leaks (or has to):

• Who registered which phone number (PSTN constraint).
• IP addresses (TLS hides traffic but not who's connecting).
• Session timing (when you're online).

Stronger systems trade UX for metadata privacy:

• Cwtch / Briar: peer-to-peer over Tor, no central server.
• Mixnets (Loopix, Nym): random delays, dummy traffic. Heavy latency overhead.
• Pond, Ricochet: TOR + anonymity, less ergonomic.

Real-world threat models matter: Signal is good against passive surveillance and provides plausible deniability. It's not designed against an attacker who controls the user's device or has root access to the OS.

Trust assumptions:

• Phone OS not malicious (compromised with root → game over).
• Device hasn't been physically tampered with.
• User verifies safety numbers when contacts re-key.