https://oshi-messenger.com/blog/ Reporting and analysis on how encrypted messengers are actually broken into: linked devices, key substitution, metadata, client-side scanning and post-quantum key exchange. Every claim is sourced, and findings that apply to OSHI itself are published here too. en OSHI Lab Sun, 13 Sep 2026 20:01:08 GMT https://oshi-messenger.com/blog/reading-signal-without-breaking-it/ https://oshi-messenger.com/blog/reading-signal-without-breaking-it/ Sun, 13 Sep 2026 00:00:00 GMT German customs investigators have been reading WhatsApp, Signal and Telegram since the end of 2023 with no malware and no attack on the cryptography. They add a second device to your account. Endpoints https://oshi-messenger.com/blog/qr-code-account-takeover/ https://oshi-messenger.com/blog/qr-code-account-takeover/ Sun, 13 Sep 2026 00:00:00 GMT A French government alert this March describes an account takeover that needs no exploit whatsoever: you are asked to scan a QR code, and the code enrols a device that is not yours. There is a second road in the same alert, and it is worse. Account takeover · Linked devices https://oshi-messenger.com/blog/spear-phishing-encrypted-messengers/ https://oshi-messenger.com/blog/spear-phishing-encrypted-messengers/ Sun, 13 Sep 2026 00:00:00 GMT State-linked actors have spent the past year going after the Signal and WhatsApp accounts of European officials. Throughout, the cryptography did precisely what it promises. Targeted attacks · Social engineering https://oshi-messenger.com/blog/verifying-who-you-are-talking-to/ https://oshi-messenger.com/blog/verifying-who-you-are-talking-to/ Sun, 13 Sep 2026 00:00:00 GMT Encryption protects a conversation between two public keys. Deciding that those keys belong to the people you meant is a different problem, it has never been solved comfortably, and in August 2026 Signal shipped the most serious attempt so far. Identity · Key verification https://oshi-messenger.com/blog/post-quantum-messaging/ https://oshi-messenger.com/blog/post-quantum-messaging/ Sun, 13 Sep 2026 00:00:00 GMT A key-encapsulation mechanism hands you one shared secret. A conversation needs a fresh one forever, in both directions, over a network that drops and reorders. Cryptography https://oshi-messenger.com/blog/post-compromise-security/ https://oshi-messenger.com/blog/post-compromise-security/ Sun, 13 Sep 2026 00:00:00 GMT Post-compromise security is a real, provable property of a key schedule, and it is worth having. It also only exists if the ratchet actually turns — ours did not — and it stops at the edge of the device, every time. Endpoints https://oshi-messenger.com/blog/metadata-and-the-social-graph/ https://oshi-messenger.com/blog/metadata-and-the-social-graph/ Sun, 13 Sep 2026 00:00:00 GMT A messenger can encrypt content perfectly and still hand an observer who talks to whom, when, how often and from where. That residue is not a footnote to the threat model. Metadata https://oshi-messenger.com/blog/chat-control-client-side-scanning/ https://oshi-messenger.com/blog/chat-control-client-side-scanning/ Sun, 13 Sep 2026 00:00:00 GMT Europe has spent four years trying to write a law that detects illegal content inside conversations nobody can read. The cipher survives every draft. Policy https://oshi-messenger.com/blog/multi-device-e2ee/ https://oshi-messenger.com/blog/multi-device-e2ee/ Sun, 13 Sep 2026 00:00:00 GMT One device is a solved problem. Add a laptop, a tablet and the phone you replaced last year, and the hard part stops being the cipher: it becomes bookkeeping. Endpoints https://oshi-messenger.com/blog/messengers-without-phone-numbers/ https://oshi-messenger.com/blog/messengers-without-phone-numbers/ Sun, 13 Sep 2026 00:00:00 GMT Signal, WhatsApp, Telegram, Olvid, SimpleX, Session, Briar, Matrix. They agree almost completely on how to encrypt a message and disagree completely on what has to be true before one can be sent — which is the part that decides what a subpoena gets. Architecture https://oshi-messenger.com/blog/ai-and-encrypted-messaging/ https://oshi-messenger.com/blog/ai-and-encrypted-messaging/ Sun, 13 Sep 2026 00:00:00 GMT AI reached encrypted messaging from two directions at once: as the thing writing the convincing message, and as the helpful feature that has to be handed the plaintext before it can help. Only the second one is a design decision you get to make. AI