PHION
Files 10 Uptime 309d Latest 0d

Threat models in private messaging: Signal, SimpleX, Session and Matrix (Techno-fascism, Part 2)

By burt Published 2026-07-23 Class Power & Society Read 11 min

Part 2 of a five-part series on techno-fascism and the tools that push back against it. Part 1 covered the machinery of surveillance capitalism — real-time bidding, data brokers, and the incentive structure that turns ordinary app use into a tracking feed. This part looks at private messaging: what end-to-end encryption actually promises, where each major app draws its threat-model line, and what each one still leaves exposed.

On 13 March 2025, National Security Adviser Mike Waltz added a contact named “JG” to a Signal group called “Houthi PC small group”. JG was Jeffrey Goldberg, editor-in-chief of The Atlantic, added by mistake. Over the following two days, eighteen participants — including Vice President JD Vance, Defense Secretary Pete Hegseth, Secretary of State Marco Rubio and Director of National Intelligence Tulsi Gabbard — used the chat to plan and narrate US air strikes on Houthi targets in Yemen, with Hegseth posting attack sequencing, aircraft types and strike timing shortly before the bombs landed. Goldberg published the full transcript once the operation was over.

Nothing about Signal’s encryption failed. The Double Ratchet session between every pair of devices in that group did exactly what it was built to do: no one outside the eighteen participants could read the messages in transit, and Signal’s servers never saw the plaintext. The failure was that an eighteenth person was let into the room in the first place. Encryption defends the pipe. It has nothing to say about who gets invited to the table — and that gap is the subject of this article.

What “end-to-end encrypted” actually promises

Three of the four apps covered here — Signal, SimpleX, and until recently Session — are built on some variant of the same two-part protocol Signal’s developers (then Open Whisper Systems) published between 2013 and 2016: X3DH for the first handshake, and the Double Ratchet for everything after.

X3DH (Extended Triple Diffie-Hellman) solves the problem of agreeing on a shared secret key when one party is offline. Each user uploads a bundle of public keys to a server in advance. When Alice wants to message Bob for the first time, she fetches his bundle, runs several Diffie-Hellman key exchanges against her own keys, and arrives at a shared secret — without Bob needing to be online at all. Bob derives the same secret the next time he checks in.

The Double Ratchet then takes over for every message after that. Each side keeps three running key chains — a root chain and one sending/receiving chain each — and every single message advances (“ratchets”) the relevant chain to a new key. Two properties fall out of this: forward secrecy (if your device is compromised today, an attacker can’t decrypt yesterday’s messages, because yesterday’s keys are already gone) and post-compromise security (the ratchet keeps moving forward, so a compromise today doesn’t compromise tomorrow’s messages either, once fresh key material is mixed back in).

That protocol answers “can someone read the message.” It says nothing about who else can see that a message was sent, when, how often, and to whom — the bidstream problem from Part 1, transposed onto messaging. That’s the axis these four apps differ on.

Diagram comparing what Signal's server, SimpleX's relays, Session's onion hops, and Matrix homeservers can each see about a conversation
Four different answers to the same question: who can see that you’re talking to someone, even though none of them can read what you said.

Signal: the reference implementation

Signal is the app the other three are reacting to, deliberately or not. It’s built and operated by the Signal Foundation, a 501(c)(3) non-profit that Brian Acton (a WhatsApp co-founder) seeded with a $50 million interest-free loan in February 2018. Signal has never taken venture capital and runs entirely on donations and that loan.

Since October 2018, Signal has shipped Sealed Sender: the sender’s identity is stripped from the outside of the message envelope and replaced with a short-lived certificate (public identity key plus expiry) sealed inside the encrypted payload itself. Signal’s server has to know who the recipient is, to route the message — but it doesn’t need to know who sent it, so it doesn’t get told. This is narrower than full anonymity — a passive network observer watching connection timing can still narrow down candidates in some cases — but it means Signal’s own infrastructure is architecturally blind to who’s messaging whom.

How little that leaves for a subpoena isn’t theoretical. Signal has published its actual responses to grand jury subpoenas since 2016. In a 2021 case out of the Central District of California, federal investigators sought a target’s name, address, correspondence records, financial data, photos, and online activity. Signal’s response, filed with the ACLU’s help, listed the only two fields it actually had: the Unix timestamp the account was created, and the Unix timestamp it last connected. No messages, no contact list, no group memberships, no profile data — because none of it exists on Signal’s servers to begin with.

The trade-off is registration. Signal has always required a phone number to create an account, tying every identity to a real-world number even if that number is never shown to contacts. In February 2024 Signal added optional usernames, so a phone number no longer has to be exposed to people you talk to — but it’s still the credential the Foundation’s servers use to register you, and still the thing a coercive actor would demand first. And because Signal is one organisation running one set of servers, it is also one legal entity, in one jurisdiction, that a government can put pressure on — which is precisely why its subpoena-response transparency matters as much as its cryptography.

SimpleX: no identifiers, not even random ones

SimpleX Chat takes the opposite architectural bet: instead of minimising what an account reveals, it removes the concept of an account. There is no username, no phone number, no persistent ID of any kind attached to a SimpleX user — not even an anonymous one generated at signup. What exists instead are temporary, per-conversation queue identifiers on relay servers called SMP servers.

To connect with someone, you generate a one-time invitation link containing a throwaway queue address. Once the other person uses it, that queue is consumed and replaced by two new, permanent-but-private queues — one for each direction of the conversation. Message content still runs over a Double Ratchet, so the cryptographic guarantees are the same family as Signal’s. What’s different is that no server anywhere holds a directory that maps “queue X” back to “person Y” across multiple conversations, because there is no such directory to hold.

The cost is younger infrastructure and a smaller network. SimpleX’s core team ran on roughly $370,000 of pre-seed funding raised in mid-2022 to work on it full-time — a fraction of what backs Signal or Matrix — and the protocol has had far fewer years of adversarial scrutiny and independent audit than Signal’s. Removing identifiers also removes phone-number-based contact discovery: there’s no way to find someone on SimpleX except by exchanging an invitation link through some other channel first, which is a real usability tax for casual, low-effort contact.

Session: pseudonymous IDs, onion-routed

Session (built by the Oxen/Session Technology Foundation, formerly Loki) sits between the two: no phone number or email is required, and an account is just a self-generated public key — a “Session ID” — with no registration step to leak to anyone. What Session adds on top is network-layer protection: messages travel through onion requests across three randomly selected Session Nodes, the same idea Tor uses. The first node knows your IP and the second node’s identity; the last node knows the destination and the second node’s identity; only the middle node sees both its neighbours, and no single node sees both ends of the connection at once. Across a network of more than 1,500 Session Nodes in over 50 countries, that onion hop is meant to make “who talked to whom” expensive to reconstruct even for someone watching the network.

Session’s real trade-off is historical, and it’s a serious one. In 2021, Session removed Perfect Forward Secrecy from its protocol, because its decentralised, multi-device architecture couldn’t keep Signal-style ratchet state synchronised across linked devices reliably. The team argued that anonymous registration and onion routing gave equivalent protection — but it meant that for four years, compromising a Session user’s key could expose their entire message history, not just messages sent after the compromise. This was specific and material enough that Privacy Guides dropped its recommendation of Session over it. It wasn’t until Session’s “V2 Protocol”, detailed in December 2025, that forward secrecy came back — via a shared cryptographic library (libsession) and periodically-rotating per-device and per-account keys — alongside a move to the post-quantum ML-KEM key exchange already used by Signal and iMessage. Running a Session Node also now requires staking cryptocurrency (formerly $OXEN, migrating to a $SESSION token), which means the network’s operators are selected by capital, not by vetting — a trust model no other app on this list uses, and one that hasn’t yet been tested by a sustained attempt to buy up node share.

Matrix: a federation, not an app

Matrix isn’t a single messenger; it’s an open, federated protocol, closer to email than to Signal. Anyone can run a “homeserver,” and homeservers talk to each other the way mail servers do. Element is the reference client, and it’s what most people mean when they say “Matrix,” but the protocol is designed for organisations to self-host their own servers under their own control — which is exactly why France’s government adopted it. Tchap, built by France’s digital directorate (DINUM) with the national cybersecurity agency ANSSI and rolled out from 2019, now serves more than 600,000 public officials, and in October 2025 DINUM became the first national government to join the Matrix.org Foundation as a paying Silver member.

Matrix’s end-to-end encryption uses Olm (an X3DH-like handshake for one-to-one sessions) and Megolm (a group ratchet, since a “room” can have hundreds of members and a full pairwise ratchet doesn’t scale). Message content under Olm/Megolm is genuinely end-to-end encrypted. But federation itself creates a structurally larger metadata footprint than any of the other three apps: every homeserver participating in a room — not one central operator, but each organisation’s own server plus every other server any member happens to be on — can see that room’s membership list, its name and topic, and the timing of activity in it. Self-hosting Matrix gives you control over your own metadata; it does nothing about the metadata your correspondent’s homeserver operator can see about the same conversation.

The cryptography has also had real, disclosed failures — not just theoretical ones. In 2022, researchers privately disclosed a set of practically exploitable cryptographic vulnerabilities in Matrix’s Olm/Megolm implementation, including a critical key-and-device-identifier confusion bug (CVE-2022-39250) and several impersonation attacks, all of which Matrix and Element patched by the coordinated disclosure date of 28 September 2022. A follow-up mechanised formal analysis published in August 2024 found that Olm has subtly weaker forward-secrecy guarantees than Signal’s protocol in certain configurations, which in turn weakens the post-compromise security Megolm and its group-messaging “Sender Keys” scheme can offer. None of this means Matrix is broken today — the specific attacks found have been fixed — but it means its cryptographic suite has a shorter, rockier audit history than Signal’s, precisely because it has to do a harder job: securing group ratchets across an open federation that anyone can extend.

What each one defends against

Signal SimpleX Session Matrix
Identity required Phone number (username optional on top) None — no accounts at all None — self-generated key Whatever your homeserver requires
Who operates the server One non-profit (Signal Foundation) Anyone — relays are swappable/self-hostable ~1,500+ staked community nodes Anyone — you or any other homeserver admin
What the operator sees Account age, last-connect time — sender hidden by Sealed Sender A disposable per-conversation queue ID No single node links both your IP and the recipient’s Full room membership, name/topic, timing
Forward secrecy Yes, since launch Yes (Double Ratchet) No from 2021–2025; restored in V2 (Dec 2025) Yes, with formally-identified subtleties (2024)
Track record ~10 years of public cryptographic scrutiny Newer; smaller audit history Rebuilt crypto in 2025 after a known gap Real CVEs found and patched (2022), reanalysed 2024

Limitations

None of these four properties protect the thing Signalgate broke: who gets added to a conversation. That’s an access-control and human-judgement problem, and encryption — sealed sender, onion routing, federation or not — has no opinion on it.

None of them protect a compromised endpoint. If malware or a forensic tool has your unlocked phone, it reads plaintext the same way you do; the protocol was never in the threat model for that case.

Contact discovery is a leak point in some form for most of these apps: finding out who else uses a service, or who’s in your address book, tends to require handing some data to someone, even when the messages themselves stay hidden. SimpleX avoids this entirely by refusing to offer discovery at all, which is a genuine trade-off, not a free lunch.

Finally, none of these apps hide from an ISP or state-level observer that you are using Signal, SimpleX, Session or Matrix in the first place, or the rough size and timing of your traffic — that’s a network-layer problem, not an application-layer one. A mixnet like the one covered in our Nym explainer addresses exactly that layer, underneath whichever messenger you choose.

Part 3 of this series moves to the browsing layer: browsers, search engines, DNS and the fingerprinting techniques that identify you even without a cookie.

Sources