Notes on privacy, Tor, and building a zero-metadata messenger.
Going post-quantum usually means parking one-time keys on a server. Our relay is forbidden from holding anything — so both phones derive the starting key instead. How YGOOW's X25519 + ML-KEM-768 hybrid works, and what it costs.
In 2024 German investigators deanonymised a Ricochet user without breaking Tor or the cipher — they timed the network and made the ISP name the subscriber. The reason it worked, and the one design choice that removes the anchor the attack needed.
In 2020 police read tens of thousands of EncroChat users' messages without breaking the encryption — they owned one central system and harvested everyone at once. Here is what actually happened, and the single architectural choice that turns that dragnet back into per-target work.
The cipher is the solved problem. The leaks live in the margins — the traffic a deaf relay still sees, and the phone someone can take from your hand. Two new defenses: shaped metadata, and a decoy profile for when you're forced to unlock.
Every other messenger chooses a default and hopes you never ask. YGOOW refuses: you pick how each conversation is protected, or you don't chat. Here is why that bluntness is the feature.
A message in YGOOW passes through up to five independent layers — transport, Tor, the end-to-end channel, locked content, and a lifetime. What each one does, in plain terms, and why they are separate on purpose.
A wrong key, a missing key, and a message that was never yours all produce the same locked block — no error, no hint, no oracle. How YGOOW's 'Variant C' trial-decryption works, and where it ends.
Why a twenty-year-old idea — anonymous, account-free data sharing — is finally shipping as an encrypted messenger.