Learn the words

Security writing loves words that keep people out. Here are the ones that matter for YGOOW, in plain language — and, for each, what it actually means for you.

Metadata

The data around your message rather than its content: who, when, how often, how big. You can encrypt every word and still leak everything through metadata. For you: YGOOW’s relay stores no “who talks to whom”, and Tor hides “from where”. What’s left, the app narrows: every block is padded to a fixed size, the conversation address rotates per-conversation, and a high-risk mode adds cover traffic to mask timing. What no low-latency network can erase — an adversary watching the whole network at once — we name openly in the whitepaper.

End-to-end encryption (E2E)

Only the people at the two ends can read the message; nothing in the middle — not the network, not the server — can. For you: the relay carries sealed blocks it cannot open.

Rendezvous (contact session)

Two people who each hold the other’s public key derive the same conversation address from the math alone — independently, with nothing sent. For you: once someone is a contact you simply write to them; there is no room code to exchange, and the server sees only an unguessable session id it cannot tie to either of you — one that rotates over time, so a single timing slip can’t unravel your whole history.

Fingerprint / safety number

A short code computed from two identities’ keys — identical on both phones only if no one swapped a key in the middle. For you: read it aloud or compare it on another channel to turn a contact from “trusted on first use” into verified; one digit off means someone is impersonating them.

Forward secrecy

If your keys are stolen today, messages you sent yesterday stay unreadable — because the key that sealed them was used once and erased. For you: a later compromise does not reach back into your history.

Post-compromise security (PCS)

The other direction in time: after a compromise, can a conversation heal so future messages become safe again? Only by mixing in fresh secret material the attacker never saw. For you: in a plain contact conversation every reply folds a brand-new key exchange into the conversation’s root, so an attacker who copies your state loses the thread again after one full round-trip. Honestly: the first chain is the exception — with no prekey server to hand us fresh material, its starting key is derived from the secret you and your contact already share, so healing begins after that first round-trip, not before. The locked-content modes don’t depend on any of this: their secrecy lives in a key the channel never holds.

Harvest now, decrypt later

An attacker who can’t read your messages today simply keeps them, betting that a future quantum computer will open the key exchange that protected them. Nothing you send today is safe from a decryption that happens in fifteen years. For you: contact conversations don’t rely on X25519 alone — a second, quantum-resistant key exchange (ML-KEM-768, the NIST standard) runs alongside it and both results are mixed together. It’s a hybrid: an attacker has to break both to read anything, so adding the new one can’t make you worse off if it turns out to be flawed. And because our relay is forbidden from holding keys for you, the starting material is derived on the two devices instead of being parked on a server for someone to seize.

Tor and onion services

Tor routes your connection through several independent relays, each peeling one layer, so no single point sees both who you are and what you reach. An onion service is a server that lives inside that network — you reach it without ever learning, or revealing, an ordinary IP address. For you: on by default, so the server never learns your address.

Guard discovery & timing correlation

How Tor users get unmasked when the cipher can’t be broken: an attacker who runs enough relays watches which entry node you keep returning to and when traffic flows, then asks your ISP who connected to it. For you, honestly: this is how German police deanonymised a Ricochet user in 2024 — without touching Tor itself. YGOOW shrinks the target — you are a Tor client, not a standing onion service an attacker can locate — and pads and isolates traffic on top; but a global adversary watching the whole network at once is the limit no low-latency system erases.

Entropy

A measure of how unguessable a secret is. A coin flip is 1 bit; a strong passphrase is 60+ bits; a public photo anyone can download is close to none. For you: YGOOW measures the real entropy of whatever key you pick and tells you the truth about it — because “your key is anything” does not mean “anything is a good key”.

KDF / Argon2id

A key derivation function turns a human secret into a cryptographic key. Argon2id is a deliberately slow, memory-hungry one, so guessing a billion passwords costs a billion times the pain. For you: weak secrets are stretched before use, buying back some of the strength a short password lacks.

Quorum (Shamir’s Secret Sharing)

A secret split into N shares so that any K of them rebuild it, and any K−1 reveal nothing. For you: a message that only opens when K of N people combine their keys — one infiltrator with one share learns nothing.

“No oracle”

An oracle is any signal that tells an attacker whether a guess was warm — an error message, a key hint, a different kind of failure. For you: a wrong key, a missing key, and a message never meant for you all produce the same locked block. Nothing to ask, nothing to learn. The long version is in “no oracle”.

Deniability

Not being able to prove what something was — or that it was anything at all. For you: because the same room can be text to one person and a lock to another, you cannot be made to prove which a given block was.

Decoy / hidden volume

A second password that opens a different, empty profile, while the real one stays hidden in the same encrypted store — with nothing on disk that proves a hidden profile exists (the idea VeraCrypt made famous for disks). For you: if you’re forced to unlock, you can reveal the decoy; the real profile is not just locked but deniable — though deniability buys a credible denial, not safety from a coercer who keeps pressing. What it also can’t hide is that you run YGOOW at all — see the trust model.

Threat model

The honest list of who you are defending against, and what you are not. A security claim without a threat model is marketing. For you: ours fits on one page — the trust model.

Your key, your rules — everything else is redacted.