Engineering behind the xPal private messaging app cross-device message deletion

4 hours ago

xPal offers four distinct deletion features: Terminate (ends a single conversation and blocks the contact), Total Wipeout (deletes all data via reverse PIN), Remote Wipeout (for lost or stolen devices), and Flicker (disappearing messages with per-message timers).
Cross-device deletion is a request, not a guarantee; once a message reaches another device, the app cannot force the recipient to delete it.
xPal uses Replace And Destruct to overwrite encrypted data before deletion, making recovery difficult.
Offline-Lock ensures that offline devices must process pending deletion requests before allowing access to chats.
xPal does not store messages long-term on servers and avoids showing message content in push notifications.
The system is designed to reduce stored data reliably under normal operation, but cannot control external recordings or screenshots.

Delta Chat 2.48+ releases minimize metadata exposure to servers via full header protection.
Outer Date header is randomized to prevent timestamp correlation attacks.
SecureJoin v3 hides cryptographic identities and ensures forward/backward compatibility.

Signal saves sensitive information permanently in account databases, including phone numbers and group metadata.
Deleting groups or chats only hides information; full deletion requires deleting all app data and re-registering without PIN.
Signal uses SMS authentication, making accounts vulnerable to takeover through SIM swaps or SMS interception.

Centralized dashboard manages up to 10 devices with individual exit selection per device.
Each device can have its own exit country, random, timed rotation, Tor, or custom pool; changes apply instantly without disconnection.
Logless architecture: logs stored only in RAM and continuously scrubbed; no traffic or IP records kept.

Inference APIs are moving from simple, portable transcripts to provider-bound, non-portable state, using encrypted reasoning, hidden search results, opaque compaction, and encrypted agent messages, locking users into a single ecosystem.
Session ownership is tested by five criteria: inspection, export, replay, audit, and deletion, which most current APIs fail because they rely on server-side IDs, encrypted blobs, and unresolved references.
Features like 'encrypted content' are misleading; they hide data from the user, not the provider, and are better termed 'provider-sealed state' for privacy theater.

EU law does not currently apply to end-to-end encrypted messages on platforms like WhatsApp and Signal.
A temporary regulation allows voluntary scanning of unencrypted messages for child sexual abuse material (CSAM) until 2028.
A permanent proposal, 'Chat Control 2.0', is under negotiation and may extend scanning to encrypted chats.

Delta Chat 2.48+ releases minimize metadata exposure to servers via full header protection.
Outer Date header is randomized to prevent timestamp correlation attacks.
SecureJoin v3 hides cryptographic identities and ensures forward/backward compatibility.

Signal saves sensitive information permanently in account databases, including phone numbers and group metadata.
Deleting groups or chats only hides information; full deletion requires deleting all app data and re-registering without PIN.
Signal uses SMS authentication, making accounts vulnerable to takeover through SIM swaps or SMS interception.

Centralized dashboard manages up to 10 devices with individual exit selection per device.
Each device can have its own exit country, random, timed rotation, Tor, or custom pool; changes apply instantly without disconnection.
Logless architecture: logs stored only in RAM and continuously scrubbed; no traffic or IP records kept.

Inference APIs are moving from simple, portable transcripts to provider-bound, non-portable state, using encrypted reasoning, hidden search results, opaque compaction, and encrypted agent messages, locking users into a single ecosystem.
Session ownership is tested by five criteria: inspection, export, replay, audit, and deletion, which most current APIs fail because they rely on server-side IDs, encrypted blobs, and unresolved references.
Features like 'encrypted content' are misleading; they hide data from the user, not the provider, and are better termed 'provider-sealed state' for privacy theater.

EU law does not currently apply to end-to-end encrypted messages on platforms like WhatsApp and Signal.
A temporary regulation allows voluntary scanning of unencrypted messages for child sexual abuse material (CSAM) until 2028.
A permanent proposal, 'Chat Control 2.0', is under negotiation and may extend scanning to encrypted chats.

Hasty Briefsbeta