From encrypted chats to decentralized messaging
Encrypted messengers are having a second wave.
Apps like WhatsApp, iMessage and Signal made end-to-end encryption (E2EE) a default expectation. But most still hinge on phone numbers, centralized servers and a lot of metadata, such as who you talk to, when, from which IP and on which device.
That is what Vitalik Buterin is aiming at in his recent X post and donation. He argues the next steps for secure messaging are permissionless account creation with no phone numbers or Know Your Customer (KYC) and much stronger metadata privacy. In that context he highlighted Session and SimpleX and sent 128 Ether (ETH) to each to keep pushing in that direction.
Session is a good case study because it tries to combine E2E encryption with decentralization. There is no central message server, traffic is routed through onion paths, and user IDs are keys instead of phone numbers.
Did you know? Forty-three percent of people who use public WiFi report experiencing a data breach, with man-in-the-middle attacks and packet sniffing against unencrypted traffic among the most common causes.
How Session stores your messages
Session is built around public key identities. When you sign up, the app generates a keypair locally and derives a Session ID from it with no phone number or email required.
Messages travel through a network of service nodes using onion routing so that no single node can see both the sender and the recipient. (You can see your message’s node path in the settings.) For asynchronous delivery when you are offline, messages are stored in small groups of nodes called “swarms.” Each Session ID is mapped to a specific swarm, and your messages are stored there encrypted until your client fetches them.
Historically, messages had a default time-to-live of about two weeks in the swarm. After that the network copy is gone, and only what is on your devices remains.
And yes, Session keeps a local database of your chats and attachments so you can scroll back months or years. That is why the app download might be around 60 to 80 MB, but the installed size grows as you send media, cache thumbnails and maintain chat history. Public documentation and independent reviews have described this split between short-lived network storage and long-lived local storage.
You can trim this by deleting chats, using disappearing messages or clearing media. If you can still see it, it lives somewhere on your device.
Fast Mode notifications
Notifications are where the privacy and user experience (UX) trade-off becomes obvious.
On iOS, Session offers two modes:
-
Slow Mode is background polling. The app wakes up periodically and checks for new messages over its own network. It is more private but can be delayed or unreliable, especially if your OS is aggressive about background activity.
-
Fast Mode uses push notifications. Session uses Apple Push Notification Service on iOS and a similar approach on Android to deliver timely alerts.
The controversial bit is Fast Mode. According to Session’s own support docs, using it means:
-
Your device IP address and push token are exposed to an Apple-operated push server.
-
Your Session Account ID and push token are shared with a Session-run push server so it knows which notifications to send where.
Crucially:
-
The servers do not see message contents because those stay E2EE.
-
Session says Apple and Google also do not see who you are talking to or the exact message timing beyond what their generic push infrastructure necessarily logs.
If that bothers you, Slow Mode exists, but you pay with missed or late notifications. That choice is part of what decentralized messengers now force users to think about.
Jurisdiction, transparency and government requests
Session’s governance has also changed.
The app was originally stewarded by the Australian nonprofit Oxen Privacy Tech Foundation (OPTF). In late 2024, a new Swiss entity, the Session Technology Foundation (STF), took over stewardship of the project. OPTF’s final transparency report covers Q4 2024; later requests are handled and published by STF.
Session’s support documentation on information requests states:
-
Because Session is decentralized and E2EE, the foundation has no special access to user messages or keys.
-
The STF publishes retrospective transparency reports summarizing law enforcement requests and how they were handled.
That transparency page is almost certainly the reference point users have in mind when they talk about a site that shows when governments ask for information. It is the public record the foundation maintains to document when authorities reach out, what they request and how Session responds.
What can they realistically hand over?
-
Potentially: Logs from websites, file servers or infrastructure they directly operate, such as push relays or STUN and TURN servers for calls, subject to Swiss law and any applicable international requests.
-
Not: Decrypted messages or master keys to user chats,…
cointelegraph.com