The Messenger Security Review
Independent coverage · 21 September 2026
KrispiTech looks inside OSHI’s mesh messenger: how messages can keep moving locally when ordinary connectivity is unavailable, and why that changes the assumptions behind private communication.
Read the independent article at KrispiTechEndpoints · Linked devices
German customs investigators have been reading WhatsApp, Signal and Telegram since the end of 2023 with no malware and no attack on the cryptography. They add a second device to your account. The maths never fails — and that is the problem.
Sourcesnetzpolitik.org · CERT-FR
13 September 2026 · ~5 min
Read the piece
Account takeover · Linked devices
A French government alert this March describes an account takeover that needs no exploit whatsoever: you are asked to scan a QR code, and the code enrols a device that is not yours. There is a second road in the same alert, and it is worse.
SourcesCERT-FR · Google Threat Intel · BSI
13 September 2026 · ~6 min
Targeted attacks · Social engineering
State-linked actors have spent the past year going after the Signal and WhatsApp accounts of European officials. Throughout, the cryptography did precisely what it promises.
SourcesBSI · BfV · Euronews
13 September 2026 · ~6 min
Identity · Key verification
Encryption protects a conversation between two public keys. Deciding that those keys belong to the people you meant is a different problem, it has never been solved comfortably, and in August 2026 Signal shipped the most serious attempt so far.
SourcesSignal · Trail of Bits
13 September 2026 · ~6 min
Cryptography · Post-quantum
A key-encapsulation mechanism hands you one shared secret. A conversation needs a fresh one forever, in both directions, over a network that drops and reorders.
SourcesSignal · NIST · IACR ePrint
13 September 2026 · ~7 min
Endpoints · Post-compromise security
Post-compromise security is a real, provable property of a key schedule, and it is worth having. It also only exists if the ratchet actually turns — ours did not — and it stops at the edge of the device, every time.
SourcesIACR ePrint · Signal · Citizen Lab
13 September 2026 · ~7 min
Metadata · Traffic analysis
A messenger can encrypt content perfectly and still hand an observer who talks to whom, when, how often and from where. That residue is not a footnote to the threat model.
SourcesPNAS · Signal · NDSS
13 September 2026 · ~6 min
Policy · Client-side scanning
Europe has spent four years trying to write a law that detects illegal content inside conversations nobody can read. The cipher survives every draft.
SourcesEUR-Lex · European Parliament · Council of the EU
13 September 2026 · ~7 min
Endpoints · Key management
One device is a solved problem. Add a laptop, a tablet and the phone you replaced last year, and the hard part stops being the cipher: it becomes bookkeeping.
SourcesSignal · Meta · WhatsApp
13 September 2026 · ~7 min
Architecture · Identity and metadata
Signal, WhatsApp, Telegram, Olvid, SimpleX, Session, Briar, Matrix. They agree almost completely on how to encrypt a message and disagree completely on what has to be true before one can be sent — which is the part that decides what a subpoena gets.
SourcesSignal · WhatsApp · Telegram
13 September 2026 · ~8 min
AI · Endpoints and plaintext
AI reached encrypted messaging from two directions at once: as the thing writing the convincing message, and as the helpful feature that has to be handed the plaintext before it can help. Only the second one is a design decision you get to make.
SourcesIC3 · NCSC · ENISA
13 September 2026 · ~8 min
About the notes under each article. Writing one needs an OSHI key: link a browser to the app and the head of your public key is published beside your note, so the same reader is recognisable across articles. Nothing else is stored — no name, no email, no address, no browser string. Reading needs nothing at all. Notes appear immediately, without review, so they are capped at 160 characters and a link typed there is never made clickable.
