Learn the words

Security writing loves words that keep people out. Here are the ones that matter for YGOOW, in plain language — and, for each, what it actually means for you.

Metadata

The data around your message rather than its content: who, when, how often, how big. You can encrypt every word and still leak everything through metadata. For you: YGOOW’s relay stores no “who talks to whom”, and Tor hides “from where”. What’s left, the app narrows: every block is padded to a size bucket, the conversation address rotates per-conversation, and a high-risk mode adds cover traffic so the relay cannot tell which frames are yours. What it narrows less than we once claimed — measured, and written down: the relay can still group one phone’s addresses from their timing. That, and the limit no low-latency network erases — an adversary watching the whole network at once — we name openly in the whitepaper.

End-to-end encryption (E2E)

Only the people at the two ends can read the message; nothing in the middle — not the network, not the server — can. For you: the relay carries sealed blocks it cannot open.

Rendezvous (contact session)

Two people who each hold the other’s public key derive the same conversation address from the math alone — independently, with nothing sent. For you: once someone is a contact you simply write to them; there is no room code to exchange, and the server sees only an unguessable session id it cannot tie to either of you — one that rotates over time, so an outside timing slip is tied to one short epoch rather than to a fixed handle.

Fingerprint / safety number

A short code computed from two identities’ keys — identical on both phones only if no one swapped a key in the middle. For you: read it aloud or compare it on another channel to turn a contact from “trusted on first use” into verified; one digit off means someone is impersonating them.

Forward secrecy

If your keys are stolen today, messages you sent yesterday stay unreadable — because the key that sealed them was used once and erased. For you: a later compromise does not reach back into your history.

Post-compromise security (PCS)

The other direction in time: after a compromise, can a conversation heal so future messages become safe again? Only by mixing in fresh secret material the attacker never saw. For you: in a plain contact conversation every reply folds a brand-new key exchange into the conversation’s root, so an attacker who copies your state loses the thread again after one full round-trip. Honestly: the first chain is the exception — with no prekey server to hand us fresh material, its starting key is derived from the secret you and your contact already share, so healing begins after that first round-trip, not before. The locked-content modes don’t depend on any of this: their secrecy lives in a key the channel never holds.

Harvest now, decrypt later

An attacker who can’t read your messages today simply keeps them, betting that a future quantum computer will open the key exchange that protected them. Nothing you send today is safe from a decryption that happens in fifteen years. For you: contact conversations don’t rely on X25519 alone — a second, quantum-resistant key exchange (ML-KEM-768, the NIST standard) runs alongside it and both results are mixed together. It’s a hybrid: an attacker has to break both to read anything, so adding the new one can’t make you worse off if it turns out to be flawed. And because our relay is forbidden from holding keys for you, the quantum-resistant key you encapsulate to is simply part of your contact’s identity — handed over when you swapped codes — instead of being parked on a server for someone to seize.

Tor and onion services

Tor routes your connection through several independent relays, each peeling one layer, so no single point sees both who you are and what you reach. An onion service is a server that lives inside that network — you reach it without ever learning, or revealing, an ordinary IP address. For you: on by default, so the server never learns your address.

Guard discovery & timing correlation

How Tor users get unmasked when the cipher can’t be broken: an attacker who runs enough relays watches which entry node you keep returning to and when traffic flows, then asks your ISP who connected to it. For you, honestly: this is how German police deanonymised a Ricochet user in 2024 — without touching Tor itself. YGOOW shrinks the target — you are a Tor client, not a standing onion service an attacker can locate — and pads and isolates traffic on top; but a global adversary watching the whole network at once is the limit no low-latency system erases.

Entropy

A measure of how unguessable a secret is. A coin flip is 1 bit; a strong passphrase is 60+ bits; a public photo anyone can download is close to none. For you: YGOOW estimates the entropy of whatever key you pick and shows it as a ceiling — “at most this strong” — because we measured our own meter and found it flatters structured passwords by tens of bits. “Your key is anything” does not mean “anything is a good key”, and a meter is not a guarantee. Where a guess costs an attacker nothing but time — a backup file — the app uses a stricter estimate that sees a dictionary word as a word.

KDF / Argon2id

A key derivation function turns a human secret into a cryptographic key. Argon2id is a deliberately slow, memory-hungry one, so guessing a billion passwords costs a billion times the pain. For you: weak secrets are stretched before use, buying back some of the strength a short password lacks. The backup file uses 256 MiB of memory per guess — a parameter we chose by measuring on the phone that memory is cheap for you and expensive for an attacker.

Quorum (Shamir’s Secret Sharing)

A secret split into N shares so that any K of them rebuild it, and any K−1 reveal nothing. For you: a message that only opens when K of N people combine their keys — one infiltrator with one share learns nothing.

“No oracle”

An oracle is any signal that tells an attacker whether a guess was warm — an error message, a key hint, a different kind of failure. For you: a wrong key, a missing key, and a message never meant for you all produce the same locked block. Nothing to ask, nothing to learn. The long version is in “no oracle”.

Dead drop

An old spy-craft term: a place where one person leaves something and another picks it up later, without the two ever meeting. For you: a Dead Drop is a one-time note behind a link — the key rides in the part of the link that never reaches a server, the relay deletes the note on the first opening, and the recipient doesn’t need the app.

Deniability

Not being able to prove what something was — or that it was anything at all. For you: because the same room can be text to one person and a lock to another, you cannot be made to prove which a given block was.

Decoy / hidden volume

A second password that opens a different profile, while the real one stays hidden in the same encrypted store (the idea VeraCrypt made famous for disks). The hard part is not the day you set it up but every day after: each write can leave a trace. For you: if you’re forced to unlock, you can reveal the decoy; to someone without the decoy password — even with repeated copies of your storage — the real profile is not just locked but deniable, and we measured that over months of use. With the decoy password, an unused decoy and a second copy of storage can still give it away; deniability buys a credible denial, not safety from a coercer who keeps pressing. What it also can’t hide is that you run YGOOW at all — see the trust model.

Side channel

A leak that bypasses the math: not what the code computes, but how long it takes or how much it sends. A multiplication that finishes faster for some key bits, a frame that is 4 bytes longer when a ratchet ran, a phone that wakes up on a schedule. For you: we measure ours on the target phone rather than assume — and publish a leak before the fix, not after: our AES-GCM library was listed as leaking in one revision and as fixed, with the measurement, in the next (alongside ML-KEM, Shamir and Ed25519). The list is in the whitepaper.

Threat model

The honest list of who you are defending against, and what you are not. A security claim without a threat model is marketing. For you: ours fits on one page — the trust model.

Your key, your rules — everything else is redacted.