The server is not a road to your phone

Three of the best-known “secure phone” networks fell without anyone breaking their encryption. EncroChat’s users lost their messages in 2020 to an implant the police pushed onto the handsets through the operator’s own infrastructure — we wrote about it. In 2024 the Australian Federal Police took down Ghost by intercepting the software updates its administrator sent to the phones, and modifying them. How Sky ECC was read in 2021 has never been disclosed; the company itself blamed a counterfeit version of its app sold through unauthorised channels.

Each operator had a road to its users’ phones. EncroChat and Ghost sent software down it, and at both, that road is how the police got in. Sky ECC, according to its US indictment, used it to wipe phones remotely.

Here is how that looks at YGOOW: what protects you already, what we guarantee for the production release, and where the protection ends.

What protects you today

If someone takes over our server

• No content, no keys. The relay holds only encrypted packets it cannot open itself, for 24 hours; an hourly job deletes them. Besides the packet, it stores only the address it was sent to, when it arrived and a delivery counter.
• No accounts. No phone numbers, no email addresses, no list of users. The server’s backups contain no messages.
• No log. Neither the website nor the relay records who connected, from where or when.
• No way into your phone. The app has no updater of its own, fetches no settings from the server and has no permission to install anything; an update must carry our signature. Our server is in Germany, at Hetzner — and taking it over gives no way into the phones that run YGOOW. That is the difference from all three networks above.
• No key to swap. The relay takes no part in exchanging keys; it only carries encrypted packets. A QR code shown face to face bypasses the network entirely. If you pass a contact code through another app, whoever controls that app could swap it — which is why YGOOW marks such a contact as unverified until you compare the safety number. The number covers both keys of both people, and a forged code for someone you already know is refused with a warning.

If someone wants to find out who you are

• Tor is on by default. While it runs, our server never sees your IP address. Switching it off is a deliberate, confirmed step, and a red bar stays on screen while it is off.
• Nothing of yours stands still on the network. Your phone connects as a client; it never runs a service anyone could probe. A standing service is what exposed a Ricochet user (we wrote about that too).
• No phone number, no account, no email. Your identity is created on your phone and stays there.
• As many identities as you need. You create extra identities and delete them whenever you like; the app sets no limit. Each has its own keys, contacts and Tor circuit, so from keys and addresses alone, someone who talks to one cannot link it to the others. Your main identity cannot be deleted — so before your first contact or conversation, create a separate one. Against our server itself, this is not enough today (see where it ends).
• Size gives almost nothing away. Message length is masked; we measured what a packet’s size still reveals about it: 0.043 bit.
• Addresses change. A conversation gets a new, unguessable address on the server about every 15 minutes. That limits what one address gives someone on the outside — not what the relay itself can link.
• Optional cover traffic. The high-risk mode adds decoy frames that, as we measured, cannot be told from real ones by size or spacing. It costs about 6.3 MiB a day per open conversation.
• Notifications without Google, and without a push broker.

If someone takes your phone

• App-lock. A password, a file, a link, a quorum of trusted people, or a YubiKey as a second factor — in any combination.
• Auto-lock. By default, after 5 minutes in the background the app locks and wipes its keys from memory. The exception: when you switch on background delivery.
• Panic lock turns off biometric unlock. The screen can’t be captured or previewed in the app switcher.
• A decoy. A second, fake set of data, opened with a different password. Without the decoy password, neither one or two copies of the phone’s storage nor the unlock time reveal the hidden data — measured over months of simulated use (details). With it, two edges remain, and we have written them down.
• Keyboard and clipboard. The keyboard is told not to learn what you type; codes you copy disappear from the clipboard after 45 seconds.
• Backup. The file is protected by a password whose check deliberately costs a lot of memory and time (Argon2id, 256 MiB), so guessing is expensive. The file is padded, and you can leave your history out.

Encryption

• AES-256-GCM on the phone’s own AES instructions; measured on ARM64, the timing leak of the library we used before is gone.
• A wrong key gives a locked block — no error message, no hint.

What we guarantee for the production release

1. Rules that won’t change. No content, keys or accounts on the server. No road from the server to your phone: no remote wipe, no remote settings, no forced updates. No access log. Tor on by default.
2. A phone taken once opens neither the past nor the future. Someone who recorded your traffic and later copies and unlocks the app’s data reads only what is in it. Deleted or expired messages can’t be decrypted from the recording, and access to new messages expires by itself at the next key exchange with your contact. The exception: the first messages of a new conversation, before the other side replies. Today this isn’t so yet — the gap is on our progress page.
3. While Tor is on, nothing leaves your phone outside it — including from other companies’ libraries. That is why, before release, we are replacing the QR scanner with one that contains no Google code.
4. Only our signature. Every release is signed with our own key, kept off the machine we build on and never handed to any store. Your phone rejects an update signed with any other key. We will publish the key’s fingerprint on the security page and in the canary. Check it the first time you install — for example with AppVerifier — and you know the copy is ours, wherever you downloaded it, even from a server someone has taken over.
5. Exchange by touching phones (NFC). We plan to ship it and are already working on it: you pass a contact, or an invitation to a conversation or room, without the network, and the invitation is encrypted within the tap itself, so listening in from close by gains nothing.
6. Outside Google Play, on GrapheneOS and standard Android. You install YGOOW directly, and Google never gets our key. Google is introducing developer registration on standard Android, worldwide from 2027, and we will register. What gets registered is our identity, the app’s name and the key’s fingerprint — never the key.

Planned

Numbers and details are on the progress page.

• A quick-start tile. Pick a safe built-in settings template, exchange a contact or a room, and start talking — without opening the settings. The goal: built-in templates look the same on the network, so picking one doesn’t single you out.
• Identity housekeeping. The app will suggest creating a separate identity before your first exchange. You will be able to delete an identity together with its contacts and conversations, and to replace the main identity with a new one.
• Bluetooth (under consideration). Exchange with phones that have no NFC, also for several people at once — at a meeting, say. Bluetooth would be on only for the exchange, never in the background, with a short code compared on both screens.
• An encrypted message header. The message number will stop linking the addresses of one conversation. Today the relay links them in 81–89 % of cases among 20 conversations.
• One channel per device, at a fixed rhythm. The goal: the relay can no longer group one phone’s addresses by timing. Today it manages 85–90 % after a single 15-minute period.
• A second lock, resistant to quantum computers, in live conversations. The goal: traffic recorded today can’t be decrypted by a future quantum computer. It is built and tested, but not yet in live conversations.
• A quantum-resistant key in the contact code, passed by NFC in one tap or as a QR code split in two.
• Groups. Members’ keys delivered so that a key stolen later doesn’t expose earlier messages; replayed key messages refused; a removed member no longer sees when the room is active.

Where it ends — because we always say so

• A malicious update. If someone forced us to sign a bad version, or stole our key, your phone would accept it. We don’t pretend this threat is gone. That is why the key stays off the build machine, and why the canary says whether anyone has demanded such a thing of us.
• A counterfeit copy. An app installed without checking the fingerprint may not be ours, and nothing in our code can protect you inside someone else’s.
• An implant on an unlocked phone sees what you see. No messenger survives that.
• A relay that watches for long enough can today group one phone’s addresses by timing alone — including the addresses of different identities on that phone. We are working on it; see the plans above.
• An observer of the whole network at once remains the limit of every low-latency network. Cover traffic raises the cost of the attack; it doesn’t grant immunity.

Your key, your rules — everything else is redacted.

← Back to blog