DEV Community: truksharoz

Why End-to-End Encryption Isn't the Whole Privacy Story

truksharoz — Thu, 23 Jul 2026 19:29:57 +0000

By J DV. Independent security researcher exploring cybersecurity, privacy, and secure system design.

People often assume that if a messaging app offers end-to-end encryption their conversations are completely private. Encryption is undoubtedly one of the strongest security technologies available today but privacy extends far beyond protecting the content of a message.

Modern messaging platforms still generate metadata, rely on cloud infrastructure and interact with operating systems in ways that can expose information about users. This article explores why encryption alone is not enough examines the broader privacy challenges facing digital communication and discusses the principles that should guide the next generation of privacy-focused technologies.

I. End-to-End Encryption Protects Messages, Not Everything

For years, end-to-end encryption (E2EE) has been presented as the gold standard for private communication. It ensures that only the sender and the intended recipient can read the contents of a message, preventing intermediaries from accessing it during transmission. This has significantly improved the security of modern messaging platforms and raised the baseline for protecting digital conversations. However, equating end-to-end encryption with complete privacy creates a misleading impression of how modern communication systems actually operate.

II. Metadata Can Reveal More Than the Message Itself

While end-to-end encryption protects the contents of a message, it does not eliminate the digital traces created around every interaction. These traces, commonly known as metadata, include information such as who communicated with whom, when the communication occurred, how frequently it happened, and, in some cases, the approximate size or type of the exchanged data. Although metadata does not reveal the actual message, it can still provide a detailed picture of a person's communication patterns and relationships.

III. Privacy Depends on the Entire Ecosystem, Not Just Encryption

Modern communication does not take place in isolation. Every message exists within a broader ecosystem that includes operating systems, cloud services, notifications, backups, connected devices, and the servers responsible for delivering communications. While end-to-end encryption protects the contents of a message, messaging platforms still need to process certain metadata—such as routing information, timestamps, or other operational data—to provide their services. The type of metadata collected and how long it is retained varies between platforms, but users often assume that only they and their device know about their conversations. In reality, privacy depends not only on message encryption but also on how the surrounding ecosystem and service infrastructure handle communication data.

IV. Privacy Ultimately Depends on Trust, Transparency, and Design

Strong encryption creates a powerful barrier against attackers attempting to intercept the contents of a conversation during transmission. However, encryption alone does not define the entire privacy model of a messaging platform. Even services such as WhatsApp, Signal, Telegram, and other modern messaging platforms rely on server infrastructure to authenticate users, route messages, exchange encryption keys where applicable, and process operational metadata required for service delivery. Although end-to-end encryption is intended to prevent service providers from accessing message contents, the overall privacy experienced by users also depends on how each platform collects, processes, and retains metadata, manages its infrastructure, and handles user data outside the encrypted message itself. Evaluating privacy therefore requires examining the complete system rather than relying on a single security feature or marketing claim.

V. Privacy Cannot Be Measured by Encryption Alone

Once the limitations of end-to-end encryption are understood, the next step is to examine what actually defines a private communication system. Encryption is a critical security technology, but it represents only one layer of a much broader privacy architecture. A realistic evaluation of any messaging platform requires looking beyond encrypted message content and assessing how the entire system operates.

A modern messaging platform can be evaluated across four fundamental layers.

The first layer is message protection. End-to-end encryption ensures that the content of a conversation remains inaccessible to unauthorized third parties while it is being transmitted. This is the foundation of secure communication, but it protects only the message itself.

The second layer is metadata handling. Every communication system generates operational information required to deliver messages. The amount of metadata collected, processed, and retained varies between platforms, making metadata protection an essential part of any privacy assessment.

The third layer is infrastructure and service architecture. Communication depends on authentication systems, message routing, notifications, cloud services, backups, and other supporting infrastructure. The way these components are designed and managed has a direct impact on the overall privacy experienced by users.

The fourth layer is user control and transparency. A privacy-focused platform should provide users with clear information about what data is collected, why it is processed, how long it is retained, and what controls users have over their own information. Transparency and user control are fundamental principles of trustworthy system design.

Encryption remains one of the strongest security technologies available today, but it should not be mistaken for complete privacy. True privacy is achieved only when message protection, metadata management, infrastructure design, and user control work together as parts of a comprehensive security model.

VI. How Server-Side Data Shapes the Privacy Model

Many users assume that end-to-end encryption means only the sender and recipient are involved in every aspect of communication. In reality, modern messaging platforms—including WhatsApp, Telegram, Signal, and others—still rely on server-side infrastructure to authenticate users, route messages, synchronize devices, deliver notifications, and operate their services. Features such as contact discovery, account management, optional cloud services, and optional location sharing also depend on server-side systems to coordinate communication between users. As a result, platforms process operational information beyond the encrypted message itself. Depending on the platform's architecture, this may include account details, device information, connection records, timestamps, routing information, and other forms of metadata that support service operation, reliability, spam prevention, fraud detection, and performance monitoring. While end-to-end encryption protects message content, the surrounding communication ecosystem continues to play a significant role in how user data is handled and how privacy is ultimately experienced.

VII. If the Service Is Free, What Pays for the Infrastructure?

Free messaging platforms often create the impression that private communication comes at no financial cost to the user. In reality, operating a global communication service requires significant resources, including data centers, servers, network bandwidth, cloud infrastructure, security operations, software development, and continuous maintenance. Every message delivered, every account authenticated, and every notification sent depends on infrastructure that must be funded.

For this reason, every platform operates under a business model. Some rely on subscriptions, some on enterprise services, some on advertising, and others on investor funding or a combination of these approaches. In certain cases, user data, analytics, or aggregated usage insights may also contribute to advertising, product improvement, market research, or business decision-making, depending on the platform's policies and practices.

This is why understanding how a platform funds its infrastructure is just as important as understanding its encryption model. Privacy is influenced not only by how messages are protected, but also by how user information is collected, processed, retained, and used within the platform's overall business and operational ecosystem.

VII. If the Service Is Free, What Pays for the Infrastructure?

Free messaging platforms often create the impression that private communication comes at no financial cost to the user. Many users assume that because they are not paying for the service, there is nothing else to consider. In reality, operating a global communication platform requires enormous investment in data centers, servers, cloud infrastructure, network bandwidth, security operations, software engineering, and continuous maintenance. Every message delivered, every account authenticated, every notification sent, and every server request consumes infrastructure that must ultimately be funded.

For this reason, every platform operates under a business model. Some rely on subscriptions, some on enterprise services, some on advertising, and others on investor funding or a combination of these approaches. Depending on the platform's policies and architecture, operational data, analytics, and aggregated usage information may also be used to improve products, measure user behavior, support market research, personalize services or advertising, and guide future business decisions. The extent to which this occurs differs between platforms.

For users, this raises an important question: if a service appears to be free, what is actually funding the infrastructure behind it? Understanding a platform's business model is just as important as understanding its encryption model. Privacy is influenced not only by how messages are protected, but also by what information is collected outside the encrypted message, how it is processed, how long it is retained, and how transparently the platform explains these practices. These factors play a central role in determining the level of privacy users actually experience.

Sources

Geopolitical Analysis & Digital Sovereignty

Mathilde Pannier (IFRI) — Software Power: The Economic and Geopolitical Implications of Open Source Software
https://www.ifri.org/en/studies/software-power-economic-and-geopolitical-implications-open-source-software

Chatham House — Trump's AI Action Plan seeks customers, not partners
https://www.chathamhouse.org/2025/07/trumps-ai-action-plan-seeks-customers-not-partners

Real Instituto Elcano — Can open source secure Europe's digital infrastructure?
https://www.realinstitutoelcano.org/en/analyses/can-open-source-secure-europes-digital-infrastructure/

Geopolitical Monitor — Distributed Risk: Open-Source Software as Strategic Infrastructure
https://www.geopoliticalmonitor.com/distributed-risk-open-source-software-as-strategic-infrastructure/

CSIS — Government Open Source Software Policies
https://www.csis.org/programs/strategic-technologies-program/resources/government-open-source-software-policies

Open Source Governance, Sanctions & Dependency

Software Freedom Conservancy — Linux banned Russian contributors. Does my FOSS project need to worry about U.S. sanctions?
https://sfconservancy.org/blog/2024/dec/12/linux-banned-russian-contributors-do-i-need-to/

Hackread — Linux Kernel Project Drops Russian Developers Amid US Sanctions Concerns
https://hackread.com/linux-kernel-project-drops-russian-developers-sanction/

TechCrunch — GitHub confirms it has blocked developers in Iran, Syria and Crimea
https://techcrunch.com/2019/07/29/github-ban-sanctioned-countries/

Felipe Contreras — The Linux Foundation is wrong about sanctions
https://felipec.wordpress.com/2024/10/26/linux-foundation-sanctions/

Corporate Influence in Open Source

The New Stack — Who Contributes to the Linux Kernel?
https://thenewstack.io/contributes-linux-kernel/

The Register — Who writes Linux and open source software?
https://www.theregister.com/2023/02/24/who_writes_open_source/

Linux Foundation — Linux Kernel Development Reports
https://www.linuxfoundation.org/

Software Supply Chain Security

Andres Freund — Initial disclosure of the XZ Utils backdoor
https://www.openwall.com/lists/oss-security/2024/03/29/4

CISA — CVE-2024-3094 XZ Utils Supply Chain Compromise Alert
https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094

Wiz Research — IngressNightmare in Kubernetes
https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities

Kubernetes Blog — Ingress-nginx CVE-2025-1974
https://kubernetes.io/blog/2025/03/24/ingress-nginx-cve-2025-1974/

Kubernetes Blog — Ingress NGINX Retirement Announcement
https://kubernetes.io/blog/2025/11/11/ingress-nginx-retirement/

China and Alternative Digital Ecosystems

Jamestown Foundation — Open-Source Technology and PRC National Strategy
https://jamestown.org/program/open-source-technology-and-prc-national-strategy-part-i/

Rest of World — China wants to build an open-source ecosystem to rival GitHub
https://restofworld.org/2021/china-gitee-to-rival-github/

European Commission — Open Source Software Country Intelligence Report: China
https://interoperable-europe.ec.europa.eu/sites/default/files/inline-files/OSS%20Country%20Intelligence%20Report%20China.pdf

A Different Approach to Privacy-Focused Communication

Traditional messaging systems often require centralized server-side infrastructure to authenticate users, route communication, synchronize devices, and provide additional services. This architecture can create operational data that must be processed and managed by the service provider.

VeilComm was created around a different privacy approach: reducing unnecessary server-side data exposure by minimizing what information needs to be collected, stored, or retained. The objective is not only to protect message content through encryption, but also to rethink how communication systems handle metadata and operational information.

Instead of building privacy around a single security layer, the approach focuses on limiting unnecessary data collection and reducing the amount of information that exists outside the user's control. By minimizing server-side data dependency, privacy risks associated with large-scale data storage, profiling, and unnecessary retention can be reduced.

The goal is simple: a communication system should not require excessive access to user information in order to provide secure communication.

Developer

VeilComm was conceived, designed, and developed by TurkSharoz (Sheroz). The project reflects an ongoing commitment to advancing practical privacy, secure communication, and user-controlled data protection through privacy-first engineering principles.

Building VeilComm: Rethinking Private Communication

truksharoz — Wed, 22 Jul 2026 18:53:48 +0000

Building VeilComm

After learning more about how messaging apps handle photos, backups, metadata, and forwarded content, I started asking a simple question:

Can private messaging be designed differently?

That question became the beginning of VeilComm.

Why I Started VeilComm

I wasn't trying to build another messaging app.

I wanted to build something that gives people more control over their own data and make privacy the starting point instead of an afterthought.

For me, privacy isn't only about encrypting messages. It's also about reducing who can access the information you share.

The Idea Behind VeilComm

VeilComm is built around three simple principles:

Collect less.
Store less.
Share less.

The less data that exists, the lower the risk of it being exposed.

What Makes VeilComm Different

VeilComm encrypts messages and files before they leave your device. The encrypted content can then be shared through existing platforms such as WhatsApp, Signal, Telegram, email, or any other service that can transfer files or messages.

Because the content is already encrypted before it is shared, the platform used for delivery does not have access to the original message or file contents. It only carries encrypted data.

VeilComm is not trying to replace existing messaging apps. Instead, it adds an extra layer of privacy that works before your data is shared.

The project also focuses on:

End-to-end client-side encryption.
Secure media and file encryption.
Privacy-focused file handling.
A simple interface that keeps privacy easy to use.

Every feature is designed with one goal in mind:

Give users more control over their own data without making secure communication complicated.

Still a Work in Progress

VeilComm is still under development, and I'm continuing to improve it with every new feature and security improvement.

In future articles, I'll explain how the encryption system works, why I chose this approach, and the engineering decisions behind building VeilComm.

What Happens When You Send a Photo Through Most Messaging Apps?

truksharoz — Wed, 22 Jul 2026 18:50:02 +0000

Sending a photo feels simple. You choose an image, tap Send, and a few seconds later it appears on someone else's phone. Behind that simple action, however, several things may happen that most people never notice.

It Starts on Your Device

The photo already exists on your phone before you send it. Depending on your device settings, it may also be part of your gallery or included in local or cloud backups.

Before the Photo Is Sent

Most messaging apps prepare the image before sending it. They may reduce the file size, create a preview, or optimize it so it can be delivered faster. These steps happen automatically in the background.

Sending the Photo

If the app supports end-to-end encryption, the photo is encrypted before it leaves your device. This helps protect the image while it is traveling across the internet.

After that, the message is routed through the app's delivery infrastructure until it reaches the recipient.

After It Arrives

Once the recipient opens the photo, it exists on their device. Depending on the app and their settings, it may also be saved to the phone's gallery or included in future backups.

At this point, the recipient can also take a screenshot or forward the image to someone else. Encryption protects the photo while it is being transmitted, but it cannot control what happens after the recipient has access to it.

Final Thoughts

When we send a photo, we often think only about the moment we press Send. In reality, there can be several stages between your device and the recipient, and in some cases, multiple copies of the same image may exist over time.

Understanding this process is an important part of understanding digital privacy.

While researching these privacy challenges, I started building VeilComm to explore how private communication could give users more control over their data—not just while it's being transmitted, but throughout its entire lifecycle.

Why Private Messaging Isn't Really Private Anymore

truksharoz — Wed, 22 Jul 2026 18:45:34 +0000

We use messaging apps every day to share photos, videos, documents, voice notes, and even sensitive information like banking details, payment confirmations, passwords, and one-time verification codes. Because many apps advertise end-to-end encryption

it's easy to believe that everything we send stays completely private.

The reality is more complicated.

Encryption protects the content of your messages while they're being transmitted but privacy doesn't end there. Metadata cloud backups screenshots forwarded media and stored copies can all affect how much of your personal information remains under your control.

What Is Metadata?

Metadata usually doesn't reveal the content of your messages but it can still paint a surprisingly detailed picture of your habits and relationships.

Cloud Backups Can Become Another Copy

Many messaging apps automatically back up chats and media to cloud storage.

This is convenient if you lose your phone, but it also means another copy of your private data may exist outside your device. If those conversations include banking information, identity documents, or payment records, that sensitive data may also become part of those backups depending on your settings and the service you use.

Screenshots and Forwarded Media

Even if a message is encrypted, nothing stops someone from taking a screenshot after opening it.

The same is true for forwarded photos, documents, or videos. Once they leave the original conversation, you often lose control over where they go next. Encryption protects data while it's being transmitted, but it doesn't automatically prevent what happens after someone receives it.

Final Thoughts

Private messaging is about more than encrypting the content of a conversation. Metadata, cloud backups, screenshots, and forwarded media all play a role in how much control you actually have over your personal information. Understanding these privacy challenges is the first step toward making better choices about how we communicate online. In the next article we'll follow the journey of a single photo and explore what can happen after you press Send.

Why Private Messaging Isn't Really Private Anymore

truksharoz — Wed, 22 Jul 2026 18:39:27 +0000

The reality is more complicated.

What Is Metadata?

Your message may be encrypted but every conversation also creates metadata. This can include when a message was sent who communicated with whom how often conversations happen and what type of device is being used.
Metadata usually doesn't reveal the content of your messages but it can still paint a surprisingly detailed picture of your habits and relationships.

Cloud Backups Can Become Another Copy

Many messaging apps automatically back up chats and media to cloud storage.

Screenshots and Forwarded Media

Even if a message is encrypted, nothing stops someone from taking a screenshot after opening it.