|
|
|
@@ -46,7 +46,7 @@
|
|
|
|
|
<tr><td>Buddy list — <strong>until you take it off</strong></td><td>Presence is shown only to people on your list, so the server holds it to enforce that. Settings offers "Take my contact list off the server": the list then lives only in your devices' encrypted stores (and rides your encrypted history export), and the honest cost is that buddies see you as offline — a presence design that needs no stored graph is the planned replacement.</td></tr>
|
|
|
|
|
<tr><td>Blocks</td><td>The server enforces them, so it has to know them. It cannot enforce one against a message that does not name its sender — blocking someone also cancels the passes you gave them, which is the part that can be aimed at one person.</td></tr>
|
|
|
|
|
<tr><td><strong>Who is in each group</strong></td><td>For every group on this server today, yes — it holds the list of members, and that is the largest single thing it knows about you. What changed is that it no longer has to. The server can now keep that list encrypted instead, with no account numbers in it anywhere: members are known to it only by random tokens it cannot tie back to anybody, and the list itself is a blob it has no key to. That much is built and running here. What is missing is the other half — the apps do not make groups that way yet, so every group that exists right now is still the old kind, held in the clear. We would rather tell you that than let “supported” be read as “you are protected”. When the apps do catch up, here is the honest shape of what it buys. It protects you from a copy of this database being stolen, or being handed over — which is the ordinary way this kind of thing actually goes wrong, and worth having. It does not hide your groups from whoever is running the server while it runs, because messages are addressed to each device: watching who receives a group’s traffic still gives the group away. So the promise this earns is “a dump of this database does not reveal your groups”, and not “the server cannot see who you talk to”. Those two sound alike and are not, and we are not going to blur them.</td></tr>
|
|
|
|
|
<tr><td><strong>What each group is called</strong></td><td>Not held. It used to be, and it should not have been: the name sat in a column the server never actually used for anything, so “Chemotherapy support” or the name of a union drive was sitting on a machine that can be broken into or handed a court order, and it bought nobody anything. It is gone, and the names that were already stored were deleted rather than just stopped. The only places the name can live now are the phones of the people in the group, which tell each other over the same encryption everything else uses. Two things follow, and neither is hidden from you. The app half of this is out now on Android, in version 0.6, and comes to iPhone once Apple approves that build — until it reaches your phone, every group reads as “Group”, which is the server declining to answer rather than anything lost. And a group you made before the change shows as “Group” until somebody in it renames it, because the old name was deleted here and no phone had ever been given a copy: there is nothing left to restore it from. Renaming arrived in that same version, for exactly this reason.</td></tr>
|
|
|
|
|
<tr><td><strong>What each group is called</strong></td><td>Not held. It used to be, and it should not have been: the name sat in a column the server never actually used for anything, so “Chemotherapy support” or the name of a union drive was sitting on a machine that can be broken into or handed a court order, and it bought nobody anything. It is gone, and the names that were already stored were deleted rather than just stopped. The only places the name can live now are the phones of the people in the group, which tell each other over the same encryption everything else uses. Two things follow, and neither is hidden from you. The app half of this is out now on Android, and comes to iPhone once Apple approves the build that carries it — until it reaches your phone, every group reads as “Group”, which is the server declining to answer rather than anything lost. And a group you made before the change shows as “Group” until somebody in it renames it, because the old name was deleted here and no phone had ever been given a copy: there is nothing left to restore it from. Renaming arrived in that same version, for exactly this reason.</td></tr>
|
|
|
|
|
<tr><td>Presence</td><td>Coarsened to the online window before it is written, never to the second</td></tr>
|
|
|
|
|
<tr><td>Delivery-key digest</td><td>The hash only. The key itself never reaches the server except inside a sealed submission</td></tr>
|
|
|
|
|
<tr><td>Per-device last-activity stamp</td><td>Coarsened to the hour before it is written. It exists so a device that falls silent for #(retention.deviceExpiryDays) days can be expired — its keys unpublished, its queued mail deleted — rather than staying addressable for ever. An account's newest device is never expired, and an account holds at most #(retention.maxDevices) devices.</td></tr>
|
|
|
|
|