Common misconceptions¶
“E2EE means anonymous.”¶
Content secrecy and identification are different properties. Account, IP and timing can remain observable.
End-to-end encryption — E2EE · [1] [2]
“The service cannot read my messages, so it knows nothing.”¶
Account dates, a number or connections can be useful without text. Distinguish capability from actually established disclosure.
“With Tor, I cannot be traced.”¶
Tor reduces some local observations; not copies, profile identity, endpoints or global correlation.
“Decentralised means private.”¶
Nodes, bootstrap, DHT or peers can see their portion of data. Actual operators must be identified.
Privacy and data minimisation · [1]
“Open source means secure.”¶
Public code helps inspection but does not prove the installed binary matches it. No current build was reproduced bit-for-bit here.
“No phone number means anonymous.”¶
It removes one identifier, not IP, purchases, reused profiles or habits.
“A VPN makes a messenger anonymous.”¶
A VPN moves network visibility and trust. It removes neither the account nor other linkage channels. Check the actual path.
“Disappearing messages mean nothing can be recovered.”¶
The contact can copy or photograph. Notifications, databases, backups and versions matter; do not generalise an old extraction to current fixes.
“P2P is necessarily more private.”¶
Less centralisation can come with IP disclosure to the peer. Calling and messaging paths are separate.
“An audit proves the whole application is safe.”¶
An audit is bounded by version, date, components and exclusions. Check fixes and retests without extending scope.
“Without the text, an investigation learns nothing.”¶
Account data, telecom, stores, ISP, devices and correspondents are different sources. One case does not generalise to all.