Notes

Ephemeral vs device-encrypted history: picking a threat model for a private chat

Something I keep running into when people set up a private chat: "should messages disappear, or should I keep history?" The honest answer is it depends on what you're actually defending against, and most apps never make you stop and think about it.

Two real options:

1) Ephemeral / nothing stored. When the room closes, the conversation is gone. Nobody - not you, not a server - can produce it later. Good when the risk is someone getting hold of a device afterward, or you just don't want a record to exist. The downside is obvious: you can't scroll back, and if you close the tab you've lost it.

2) History encrypted on your own device. You keep the conversation, but it's stored encrypted locally, not on a server. Good when you genuinely need to refer back to what was said. The tradeoff: whoever can unlock your device can read it, so now your device security is the weak point.

The part people skip over is where the history is NOT: there is no server-side message store either way. A lot of "private" chat keeps an encrypted-ish copy on someone's server "for sync," which quietly changes your threat model - now you're trusting that server's retention and access policies, not just your own device.

What I don't think you should do is treat "disappearing messages" as anonymity. It isn't. Ephemeral history protects against later recovery of message content; it does nothing about who you talked to, or - in a peer-to-peer setup - the fact that peers can see each other's IP addresses over the connection. If your threat model includes hiding that you communicated at all, this is the wrong category of tool. You'd want something with real metadata resistance, not a no-account browser chat.

The browser tool I've been poking at for this is chat.to-go.io ( https://chat.to-go.io ) - E2E-encrypted, peer-to-peer, no account, and it actually lets you pick: keep nothing, or keep history encrypted on your device. No server in the middle storing the messages. It's not a Signal replacement and it doesn't pretend to hide your IP from the people in the room. But for "I want a quick private room and I want to decide whether a record exists," the ephemeral-vs-local choice is exactly the right question to put in front of someone.

Pick the threat model first, then the storage mode. Not the other way around.