Pith. sign in

REVIEW 5 minor 79 references

Send and Pretend: Exploiting Transcript Consistency Issues in End-to-End Encrypted Group Chats

T0 review · 0 major / 5 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read All four major end-to-end encrypted messengers fail to guarantee transcript consistency, letting a malicious group member show different messages to different participants without detection.

desk verdict Strong empirical paper showing major E2EE messengers fail to provide transcript consistency; the core claim holds for Signal and Threema, and is credible but slightly less airtight for WhatsApp and iMessage due to unofficial-client testing. read the letter →

arxiv 2607.27510 v1 pith:GYKVWNKZ submitted 2026-07-29 cs.CR

Gabriel K. Gegenhuber , Moritz Grefner , Maximilian Günther , Matthäus Wininger , David Schmidt , Aljosha Judmayer This is my paper · ORCID
classification cs.CR
keywords transcriptconsistencyend-to-endencryptiongroupmessagingSenderKeyprotocolmessageequivocationpollmanipulationWhatsAppSignal
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks whether participants in end-to-end encrypted group chats all end up seeing the same conversation. It answers no: in current versions of WhatsApp, Signal, iMessage, and Threema, no form of transcript consistency is guaranteed. A malicious group member can omit, reorder, or rewrite messages for selected recipients, and neither the server nor the receiving client flags the discrepancy. The same weakness lets a poll creator or voter rig polls, since poll results render as authoritative shared state. The paper shows the problem is structural — pairwise fan-out is equivocation by design, and Sender Key implementations reopen equivocation through retransmission fallbacks, sender-defined recipient lists, and deduplication by message ID.

What carries the argument

The paper's central objects are the two group delivery models and their failure modes. Client fan-out encrypts one plaintext per recipient; this is inherently equivocation-prone because the sender can choose per-recipient plaintexts, and iMessage and Threema rely on it for groups. Server fan-out (Sender Key) broadcasts one ciphertext to all, but the protocol's recovery path — pairwise retransmission after decryption failure — gives the sender a sanctioned channel for recipient-specific content. Message-ID-based deduplication makes later contradictory broadcasts silently ignored. Polls hang on the same message-ID references, so option indices, question text, and final states can be replayed o

What would settle it

A single counterexample would settle it: take the current official WhatsApp client, cause a decryption failure in a group message, and check whether an unsolicited pairwise retransmission disguised as a retry is accepted and rendered, and whether deduplication by message ID ignores a later contradictory Sender Key broadcast. If the official client rejects or warns on any of these paths, the paper's WhatsApp claim fails. The same test applied to the official Signal, iMessage, and Threema clients on current versions would delimit the claim's scope.

Watch

Extended reading notes

Core claim

The central claim is that transcript consistency (TC) — the property that honest group members eventually converge on the same set, order, and content of messages — is absent from every prevalent E2EE messenger tested. The authors define four increasingly strong TC variants (set, per-participant, causal, total) and show that none of the four services satisfies even the weakest. Equivocation is demonstrated under a malicious-participant threat model: the attacker controls one group member's client and sends differently addressed ciphertexts, exploiting Sender Key fallback retransmissions, pairwise E2EE channels, and message-ID-based deduplication. They further show that polls, which reference

Load-bearing premise

The claim that all four deployed messengers lack TC rests on experiments conducted with unofficial client implementations for WhatsApp and iMessage and specific client versions for all four; if the official clients' wire behavior differs in how retransmissions or message IDs are generated, the negative-universal conclusion would need revision.

Editorial extensions

If this is right

  • If the paper is right, no deployed major E2EE messenger currently provides even set-level transcript consistency in group chats, so users cannot assume a shared conversation record.
  • Social engineering and moderation-evasion attacks are practical today: a malicious participant can send benign content to moderators and phishing content to selected victims, with no server-side or UI detection.
  • Polls are riggable on all four services, both by creators (reordering options, inverting questions, dictating results) and by voters (injecting hidden votes), so poll outcomes are not trustworthy evidence of group opinion.
  • The proposed minimal Sender Key changes — dropping unsolicited pairwise retransmissions, enforcing group-wide broadcast, broadcasting retry requests, and surfacing decryption errors in the UI — would convert silent equivocation into visible warnings.
  • Implementation quirks, such as OS-specific message-ID formats and poll parsing, leak device metadata and create cross-platform inconsistencies that amplify the attacks.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An implication the paper leaves implicit is that simply moving a messenger to Sender Key does not fix TC; any fallback path that allows pairwise delivery reopens equivocation, so TC must be designed into the broadcast domain itself.
  • A consequence not developed in the paper is that the WhatsApp message-ID prefix leak could be used outside the group context for stalking or targeted phishing: anyone who can read a received message ID can infer the sender's OS and device class.
  • A testable extension of the paper's account is that decryption-failure rates during normal operation should be near zero; if real-world retransmissions are frequent, the proposed warning-based mitigation would suffer from false positives, a point the paper itself flags as future work.
  • The vendor responses reported in the paper suggest TC is not currently a security goal for any of the four platforms; if that holds, users of these apps should treat group-chat content as unauthenticated shared state until vendors explicitly adopt TC.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

0 major / 5 minor

Summary. The paper investigates transcript consistency (TC) in four major E2EE group messaging services (WhatsApp, Signal, iMessage, Threema) under a malicious-participant threat model. It defines four increasingly strong TC variants (STC, PTC, CTC, TTC) and demonstrates that none of the four services provides any of them. The core technical contribution is an empirical study of equivocation vectors: pairwise client fan-out is inherently equivocable; Sender Key-based services are vulnerable through pairwise fallback/retransmission paths, unsolicited pairwise group messages, and Sender Key broadcasts with message-ID-based deduplication. The paper also shows practical exploitation of these vectors, most notably for rigging polls, and reports implementation-specific issues such as fabricated quote references, iMessage vote spoofing for other participants, OS-dependent WhatsApp poll parsing, and OS/device fingerprinting via WhatsApp message IDs. It proposes lightweight countermeasures for Sender Key-based messengers and documents responsible disclosure to all four vendors.

Significance. If correct, this is an important negative result: no major deployed E2EE group messenger guarantees even the weakest form of transcript consistency against a malicious group member, and the cause is structural rather than a single implementation bug. The empirical methodology is a particular strength: the attacks were executed against unmodified official victim clients, PoC videos are provided, and the code is released on GitHub and Zenodo. The paper's TC taxonomy usefully organizes prior and new work, and the threat model is explicit. The central claim is established by direct experimentation, not by self-citation; the authors' earlier work is used only as context. The vendor disclosures and responses add credibility. The proposed countermeasures are admittedly partial and not formally proven, but they are presented as practical mitigations rather than as a full protocol redesign, which is appropriate for this contribution.

minor comments (5)
  1. [§4.2] The paper should explicitly address the use of unofficial clients (whatsmeow for WhatsApp, rustpush for iMessage) for the attacker side. Under the stated threat model, an attacker fully controls their own devices and may run any client or instrument the official app, so the experiments are valid as demonstrations. Nevertheless, the negative universal claim would be strengthened by an explicit limitation statement acknowledging that the attacker-side wire behavior was validated from unofficial implementations and that the conclusion is scoped to the specific client/server versions tested in early 2026.
  2. [§5.1.3] The Sender Key-only vector is described ambiguously for WhatsApp. Because the WhatsApp server broadcasts to all group members, the 'multiple versions' attack cannot rely on sender-defined recipient lists as in Signal; rather, it relies on message-ID-based deduplication and on at least one recipient not having received the original message (e.g., after a retry request). The prose should spell out this exact delivery/deduplication sequence so that readers do not infer that WhatsApp permits targeted Sender Key recipient lists. The distinction from the Signal case is important and is currently buried.
  3. [Appendix A.1] The TC definitions use 'eventually' and an informal asynchronous model. The bound f ≤ floor((n-1)/3) is a consensus-possibility condition, but the attacks themselves require only at least one malicious participant in a sufficiently large group. The relationship between this Byzantine-agreement bound and the demonstrated violations should be stated explicitly: the definitions describe when TC is achievable in principle, while the attacks show violations even when no such consensus guarantee is provided. Also, the wording 'controlled by a subset of Byzantine participants' should clarify whether the adversary controls exactly f participants or at most f.
  4. [Table 2] The table heading 'One-to-One (1:1) Group Chats' is malformed and confusing. It should be split into two headings, e.g., '1:1 Chats' and 'Group Chats', or the table should be restructured so that the two settings are clearly labeled as separate column groups. As printed, the caption suggests a single category that spans two settings.
  5. [References / Text] Minor typographical issues: reference [25] lists the author as 'Aljosha Jud ayer' (should be 'Judmayer'), and §2.2 contains an obvious formatting artifact 'groups V2orzkgroups'. Please proofread these and similar inline artifacts. The message-ID fingerprinting table (Table 3) is a nice contribution but would benefit from a note on how the prefix/length values were collected and whether they are stable across client versions.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity; the negative TC results are empirical and self-contained.

full rationale

The paper's central claim—that WhatsApp, Signal, iMessage, and Threema fail to provide transcript consistency under a malicious-participant threat model—is established by direct, version-specific experimentation against the services (Section 4.2, Table 1), not by deriving it from the authors' definitions or prior work. The TC taxonomy in Section 2.3 and Appendix A.1 defines STC/PTC/CTC/TTC as formal properties and explicitly anchors them in prior concepts ([32] consensus, [67] speaker consistency/global transcript), but the finding that none of the four services meets even the weakest variant (STC) rests on observed equivocation vectors (Sections 5.1.1–5.1.3) and victim-side rendering on unmodified official clients. The self-citations ([24,25,26,30], Section 7) supply only related-work context about prior messenger attacks and are not used to justify the negative-universal claim. The use of unofficial clients (whatsmeow, rustpush) for two platforms raises an external-validity question about whether the attacker-side wire behavior matches official clients, but this is a methodological limitation, not a circularity: the experiments are not fitted to a target result, and the conclusions do not reduce by construction to the inputs. Accordingly, no circular step is present.

Assumptions & free parameters 0 free parameters · 4 assumptions · 1 invented entities

The central claim rests on direct experimentation against the four deployed services rather than on derived or fitted quantities: there are no free parameters. The axioms are the threat model (malicious registered participant), the classic Byzantine bound used only to make the TC definitions meaningful, the representativeness of the tested clients and versions (the weakest premise, since the universal negative is extrapolated from specific builds), and, for the mitigation section only, an honest-with-respect-to-delivery server. The one introduced conceptual artifact is the four-tier TC taxonomy, which is definitional and anchored in prior work rather than an independently testable entity.

assumptions (4)
  • domain assumption Adversary is a registered group member who fully controls own devices and local protocol state, may deviate from the protocol, but cannot break cryptographic primitives, does not control or collude with the server, and lacks other users' secrets.
    Threat model, Section 3. This definition of the attacker governs which of the four services count as 'vulnerable'.
  • standard math Transcript agreement under asynchrony with Byzantine participants requires the adversary to control at most f <= (n-1)/3 participants (classic Byzantine agreement bound; cites [17,66]).
    Appendix A.1, used to justify the definitional framework of STC/PTC/CTC/TTC, not the empirical attack results.
  • domain assumption The tested client builds and service versions (early 2026) are representative of 'today's major E2EE messengers'; unofficial clients (whatsmeow, rustpush) faithfully reproduce official attacker behavior for WhatsApp/iMessage.
    Section 4.2 and Table 1; the universal negative claim extends from these tests. This is the study's weakest load-bearing premise.
  • domain assumption For the mitigation section only: the centralized server is honest with respect to message delivery and can be trusted to add timestamps and enforce group broadcast.
    Section 6.1: 'If the server is assumed to be honest with respect to message delivery...' The authors argue this is already implicit because servers can drop messages. This assumption does not affect the attack findings.
invented entities (1)
  • TC taxonomy: STC, PTC, CTC, TTC (set/participant/causal/total transcript consistency)
    purpose: Provides a precise vocabulary for which consistency guarantee each messenger lacks and what the mitigations could restore.
    Sections 2.3 and A.1. These are definitions, not empirically testable entities; they are grounded in prior concepts ([32] consensus, [67] speaker consistency/global transcript, [21] transcript agreement). 'No independent evidence' is appropriate for a definitional contribution and should not be read as a weakness.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Send and Pretend: Exploiting Transcript Consistency Issues in End-to-End Encrypted Group Chats." pith.science (2026). https://pith.science/paper/GYKVWNKZ

@misc{pith2026260727510,
  author       = {Pith},
  title        = {Pith review of: Send and Pretend: Exploiting Transcript Consistency Issues in End-to-End Encrypted Group Chats},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GYKVWNKZ}},
  note         = {Machine review of arXiv:2607.27510}
}
read the original abstract

End-to-end encrypted (E2EE) messaging apps are widely praised for their security and thus also used for sensitive coordination in group chats (e.g., by political decision makers). After Threema and WhatsApp, also Signal and iMessage have recently introduced polls to aid agreement processes in groups. This implicitly sets the expectation that all participants see the same outcome and thus have the same view of the conversation. This property is commonly referred to as transcript consistency (TC). In this work, we demonstrate that today's major E2EE messengers do not guarantee any form of TC for group chats, allowing a malicious group member to selectively omit, reorder, or present altered content to different recipients without triggering warnings in their user interface. We systematically investigate the extent of the problem under a malicious-participant threat model that targets the integrity of the shared transcript, or inconsistent delivery across a user's linked devices. We identify multiple equivocation vectors that range from protocol fallback paths to deliberate use of pairwise delivery channels within groups. We demonstrate concrete exploitation scenarios such as social engineering, evading moderation, and, in particular, rigging polls. Beyond these cross-service design issues, we also uncover implementation-specific behaviors with privacy implications (e.g., device OS fingerprinting). Finally, we contextualize our findings within prior transcript-consistency research and outline practical low-overhead mitigations and UI signaling strategies that can be integrated into state-of-the-art E2EE group protocols.

Figures

Figures reproduced from arXiv: 2607.27510 by the authors.

Figure 1
Figure 1. Side-by-side views of a group chat from each participant’s perspective. Each panel represents the local transcript on a [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Comparison of client-side and server-side fan-out message delivery models. [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Costs of different group messaging schemes. [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Group communication with sender key messages [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 6
Figure 6. Figure 6: Group communication based on pairwise E2EE is inherently prone to equivocation attacks. While some mes￾sengers still use it as the default transmission path in groups (iMessage, Threema), we evaluate whether it can nevertheless be leveraged for group communication on t…
Figure 7
Figure 7. Figure 7: By default, WhatsApp shows a decryption error [PITH_FULL_IMAGE:figures/full_fig_p007_7.png]
Figure 10
Figure 10. Figure 10: A malicious poll creator can send different ques [PITH_FULL_IMAGE:figures/full_fig_p008_10.png]
Figure 11
Figure 11. Figure 11: Screenshots of fake quote references on WhatsApp [PITH_FULL_IMAGE:figures/full_fig_p009_11.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

79 extracted references · 6 canonical work pages

  1. [1]

    Accessed: 2026-01-27

    Apple Community – Sending group messages to 50+ recipients. Accessed: 2026-01-27. URL: https://di scussions.apple.com/thread/255951019

    arXiv 2026

  2. [2]

    Accessed: 2026-01-27

    GitHub – Rustpush. Accessed: 2026-01-27. URL: https://github.com/OpenBubbles/rustpush

    2026

  3. [3]

    Accessed: 2026-01-

    GitHub – Signal Desktop. Accessed: 2026-01-

    2026

  4. [4]

    Accessed: 2026-01-27

    GitHub – Threema for Android. Accessed: 2026-01-27. URL: https://github.com/threema-ch/threema- android

    2026

  5. [5]

    Accessed: 2026-01-27

    GitHub – whatsmeow. Accessed: 2026-01-27. URL: https://github.com/tulir/whatsmeow

    2026

  6. [6]

    Accessed: 2026-01-23

    iMessage Statistics. Accessed: 2026-01-23. URL: https://usesignhouse.com/blog/imessage- stats/

    2026

  7. [7]

    Accessed 2026-01-23

    Meta just killed native WhatsApp on Windows 11, now it opens WebView. Accessed 2026-01-23. URL: https://www.windowslatest.com/2025/11/ 12/meta-just-killed-native-whatsapp-on-wi ndows-11-now-it-opens-webview-uses-1gb-r am-all-the-time/

    2026

  8. [8]

    Accessed: 2026-01-23

    Signal Statistics. Accessed: 2026-01-23. URL: https://www.businessofapps.com/data/signal- statistics/

    2026

Show all 79 references
  1. [9]

    Accessed: 2026-01-

    Threema Press Information. Accessed: 2026-01-

    2026

  2. [10]

    Messages for iPhone, iPad, Apple Watch, and Mac

    Apple. Messages for iPhone, iPad, Apple Watch, and Mac. Accessed: 2026-01-27. URL: https://suppor t.apple.com/messages

    2026

  3. [11]

    Analysis and Improvements of the Sender Keys Protocol for Group Messaging.CoRR, abs/2301.07045, 2023

    David Balbás, Daniel Collins, and Phillip Gajland. Analysis and Improvements of the Sender Keys Protocol for Group Messaging.CoRR, abs/2301.07045, 2023. arXiv: 2301.07045. URL: https://doi.org/10. 48550/arXiv.2301.07045, doi:10.48550/ARXIV. 2301.07045

    2023 doi arXiv

  4. [12]

    What- sUpp with Sender Keys? Analysis, Improvements and Security Proofs

    David Balbás, Daniel Collins, and Phillip Gajland. What- sUpp with Sender Keys? Analysis, Improvements and Security Proofs. In Jian Guo and Ron Steinfeld, editors, Advances in Cryptology - ASIACRYPT 2023 - 29th In- ternational Conference on the Theory and Application of Crypto...

    2023 doi

  5. [13]

    The Messaging Layer Security (MLS) Protocol, July 2023

    Richard Barnes, Benjamin Beurdouche, Raphael Robert, Jon Millican, Emad Omara, and Katriel Cohn-Gordon. The Messaging Layer Security (MLS) Protocol, July 2023. Issue: 9420 Num Pages: 132 Series: Request for Comments Published: RFC

    2023

  6. [14]

    On Active Attack Detection in Messaging with Immediate Decryption

    Khashayar Barooti, Daniel Collins, Simone Colombo, Loïs Huguenin-Dumittan, and Serge Vaudenay. On Active Attack Detection in Messaging with Immediate Decryption. In Helena Handschuh and Anna Lysyan- skaya, editors,Advances in Cryptology - CRYPTO 2023 - 43rd Annual Internationa...

    2023

  7. [15]

    Signal Polls: Yes, no, maybe (yes!)

    Nina Berman. Signal Polls: Yes, no, maybe (yes!). Accessed: 2026-01-27. URL: https://signal.org/ blog/polls

    2026

  8. [16]

    The Messaging Layer Security (MLS) Architecture, April 2025

    Benjamin Beurdouche, Eric Rescorla, Emad Omara, Srinivas Inguva, and Alan Duric. The Messaging Layer Security (MLS) Architecture, April 2025. Issue: 9750 Num Pages: 41 Series: Request for Comments Pub- lished: RFC 9750. URL: https://www.rfc-editor .org/info/rfc9750,doi:10.1748...

    2025 doi

  9. [18]

    Christian Cachin, Rachid Guerraoui, and Luís E. T. Ro- drigues.Introduction to Reliable and Secure Distributed Programming (2. ed.). Springer, 2011. doi:10.1007/ 978-3-642-15260-3

    2011

  10. [19]

    The Signal Private Group System and Anonymous Creden- tials Supporting Efficient Verifiable Encryption

    Melissa Chase, Trevor Perrin, and Greg Zaverucha. The Signal Private Group System and Anonymous Creden- tials Supporting Efficient Verifiable Encryption. In Jay Ligatti, Xinming Ou, Jonathan Katz, and Giovanni Vi- gna, editors,CCS ’20: 2020 ACM SIGSAC Conference on Computer an...

    2020

  11. [20]

    Integrating Causality in Messaging Channels

    Shan Chen and Marc Fischlin. Integrating Causality in Messaging Channels. In Marc Joye and Gregor Leander, editors,Advances in Cryptology - EUROCRYPT 2024 - 43rd Annual International Conference on the Theory and Applications of Cryptographic Techniques, Zurich, Switzerland, Ma...

    2024 doi

  12. [21]

    On Ends-to-Ends Encryp- tion: Asynchronous Group Messaging with Strong Se- curity Guarantees

    Katriel Cohn-Gordon, Cas Cremers, Luke Garratt, Jon Millican, and Kevin Milner. On Ends-to-Ends Encryp- tion: Asynchronous Group Messaging with Strong Se- curity Guarantees. In David Lie, Mohammad Mannan, Michael Backes, and XiaoFeng Wang, editors,Proceed- ings of the 2018 ACM...

    2018

  13. [22]

    Consensus in the Presence of Partial Synchrony.Jour- nal of the ACM, 35(2):288–323, 1988

    Cynthia Dwork, Nancy Lynch, and Larry Stockmeyer. Consensus in the Presence of Partial Synchrony.Jour- nal of the ACM, 35(2):288–323, 1988. doi:10.1145/ 42282.42283

    1988

  14. [23]

    URL: https://threema.com/press-files/1_ press_info/press_threema_portrait_en.pdf

  15. [24]

    Garske, Swantje Lange, Gabriel K

    Viktor E. Garske, Swantje Lange, Gabriel K. Gegenhu- ber, David Schmidt, Andreas Noack, and Jiska Classen. Blue Bubbles, Red Flags: Investigating Privacy Leakage in Apple iMessage. InProceedings of the 2026 ACM SIGSAC Conference on Computer and Communications Security, 2026

    2026

  16. [25]

    Gegenhuber, Philipp É

    Gabriel K. Gegenhuber, Philipp É. Frenzel, Maximilian Günther, and Aljosha Jud ayer. Prekey Pogo: Investigat- ing Security and Privacy Issues in WhatsApp’s Hand- shake Mechan sm. In19th USENIX WOOT Conference on Offensive Technologies (WOOT), 2025

    2025

  17. [26]

    A Cryptographic Look at Multi-party Chan- nels

    Patrick Eugster, Giorgia Azzurra Marson, and Bertram Poettering. A Cryptographic Look at Multi-party Chan- nels. In31st IEEE Computer Security Foundations Sym- posium, CSF 2018, Oxford, United Kingdom, July 9-12, 2018, pages 31–45. IEEE Computer Society, 2018. doi: 10.1109/CSF...

    2018

  18. [27]

    URL: https://github.com/signalapp/Si gnal-Desktop

  19. [28]

    Gegenhuber, Moritz Grefner, Maximilian Günther, Matthäus Wininger, David Schmidt, and Aljosha Judmayer

    Gabriel K. Gegenhuber, Moritz Grefner, Maximilian Günther, Matthäus Wininger, David Schmidt, and Aljosha Judmayer. Duplicate Message ID in Sig- nal. URL: https://github.com/sbaresearch/ transcript-consistency/blob/main/videos/si gnal/15/desktop-duplicate-handling-1.mkv

  20. [29]

    Gegenhuber, Philipp É

    Gabriel K. Gegenhuber, Philipp É. Frenzel, Maximilian Günther, Johanna Ullrich, and Aljosha Judmayer. Hey there! You are using WhatsApp: Enumerating Three Bil- lion Accounts for Security and Privacy. In33rd Annual Network and Distributed System Security Symposium (NDSS), 2026

    2026

  21. [30]

    Gegenhuber, Moritz Grefner, Maximilian Günther, Matthäus Wininger, David Schmidt, and Aljosha Judmayer

    Gabriel K. Gegenhuber, Moritz Grefner, Maximilian Günther, Matthäus Wininger, David Schmidt, and Aljosha Judmayer. Duplicate Message Edit ID in Signal. URL: https://github.com/sbaresearch/ transcript-consistency/blob/main/videos/si gnal/16/desktop-duplicate-handling-2.mkv

  22. [31]

    WhatsApp Revamps Group Chats with New Communities Feature

    Thomas Germain. WhatsApp Revamps Group Chats with New Communities Feature. Accessed: 2026-01-27. URL: https://gizmodo.com/whatsapp-communiti es-new-group-chat-feature-1849737258

    2026

  23. [32]

    Gegenhuber, Moritz Grefner, Maximilian Günther, Matthäus Wininger, David Schmidt, and Aljosha Judmayer

    Gabriel K. Gegenhuber, Moritz Grefner, Maximilian Günther, Matthäus Wininger, David Schmidt, and Aljosha Judmayer. Malicious Signal Message Refer- encing Future Message. URL: https://github.com/ sbaresearch/transcript-consistency/blob/ main/videos/signal/14/fake-quote-2-wrong-...

  24. [33]

    Gegenhuber, Maximilian Günther, Markus Maier, Aljosha Judmayer, Florian Holzbauer, Philipp É

    Gabriel K. Gegenhuber, Maximilian Günther, Markus Maier, Aljosha Judmayer, Florian Holzbauer, Philipp É. Frenzel, and Johanna Ullrich. Careless Whisper: Ex- ploiting Silent Delivery Receipts to Monitor Users on Mobile Instant Messengers, 2024. URL: https://ar xiv.org/abs/2411....

    2024

  25. [34]

    EU Signal Group: Too sensitive for release, not sensitive enough for archiving, November 2025

    Martin Holland. EU Signal Group: Too sensitive for release, not sensitive enough for archiving, November 2025. URL: https://www.heise.de/en/ news/EU-Signal-Group-Too-sensitive-for-r elease-not-sensitive-enough-for-archiving- 11080698.html

    2025

  26. [35]

    Multi-party off-the-record messaging

    Ian Goldberg, Berkant Ustaoglu, Matthew Van Gundy, and Hao Chen. Multi-party off-the-record messaging. In Ehab Al-Shaer, Somesh Jha, and Angelos D. Keromytis, editors,Proceedings of the 2009 ACM Conference on Computer and Communications Security, CCS 2009, Chicago, Illinois, U...

    2009

  27. [36]

    Kollmann, Diana A

    Martin Kleppmann, Stephan A. Kollmann, Diana A. Vasile, and Alastair R. Beresford. From Secure Messaging to Secure Collaboration. In Vashek Matyás, Petr Svenda, Frank Stajano, Bruce Christianson, and Jonathan Anderson, editors,Security Protocols XXVI - 26th International Works...

    2018

  28. [37]

    The Trump Administration Ac- cidentally Texted Me Its War Plans, March 2025

    Jeffrey Goldberg. The Trump Administration Ac- cidentally Texted Me Its War Plans, March 2025. URL: https://www.theatlantic.com/politics/ archive/2025/03/trump-administration-acci dentally-texted-me-its-war-plans/682151

    2025

  29. [38]

    Apple is bringing polls to Messages in iOS 26

    Aisha Malik. Apple is bringing polls to Messages in iOS 26. Accessed: 2026-01-27. URL: https:// techcrunch.com/2025/06/09/apple-is-bringi ng-polls-to-imessage-in-ios-26

    2026

  30. [39]

    Technology Preview: Signal Private Group Sys- tem, December 2019

    jimio. Technology Preview: Signal Private Group Sys- tem, December 2019. URL: https://signal.org/ blog/signal-private-group-system/

    2019

  31. [40]

    Aviv, Daniel S

    Ian Martiny, Gabriel Kaptchuk, Adam J. Aviv, Daniel S. Roche, and Eric Wustrow. Improving Signal’s Sealed Sender. In28th Annual Network and Distributed System Security Symposium, NDSS 2021, virtually, February 21-25, 2021. The Internet Society, 2021. URL: https://www.cs.umd.ed...

    2021

  32. [41]

    Despite misleading marketing, Israeli company TeleMessage, used by Trump officials, can access plaintext chat logs, May 2025

    Micah Lee. Despite misleading marketing, Israeli company TeleMessage, used by Trump officials, can access plaintext chat logs, May 2025. URL: https:// micahflee.com/despite-misleading-marketi ng-israeli-company-telemessage-used-by-tr ump-officials-can-access-plaintext-chat- logs/

    2025

  33. [42]

    WhatsApp – How to join a group in a com- munity

    Meta. WhatsApp – How to join a group in a com- munity. Accessed: 2026-01-27. URL: https://faq. whatsapp.com/967457667545238/

    2026

  34. [43]

    Private Group Messaging, May

    Moxie Marlinspike. Private Group Messaging, May

  35. [44]

    The Sleepy Model of Con- sensus

    Rafael Pass and Elaine Shi. The Sleepy Model of Con- sensus. InAdvances in Cryptology – ASIACRYPT 2017, volume 10624 ofLecture Notes in Computer Science, pages 380–409. Springer, 2017. doi:10.1007/978-3- 319-70697-9_14

    2017 doi

  36. [45]

    Ole André V . Ravnås. Frida – A world-class dynamic instrumentation toolkit. URL:https://frida.re/

  37. [46]

    New Updates to Polls and Sharing With Captions on WhatsApp

    Meta. New Updates to Polls and Sharing With Captions on WhatsApp. Accessed: 2026-01-27. URL: https:// about.fb.com/news/2023/05/whatsapp-polls- updates-sharing-with-captions

    2026

  38. [47]

    Messaging Layer Security (MLS): To- wards More End-to-End Encryption, July 2025

    Raphael Robert. Messaging Layer Security (MLS): To- wards More End-to-End Encryption, July 2025. Pub- lished: Presentation, Pass the SALT 2025

    2025

  39. [48]

    Transcript Franking for Encrypted Messaging

    Armin Namavari and Thomas Ristenpart. Transcript Franking for Encrypted Messaging. In Goichiro Hanaoka and Bo-Yin Yang, editors,Advances in Cryp- tology - ASIACRYPT 2025 - 31st International Confer- ence on the Theory and Application of Cryptology and Information Security, Mel...

    2025 doi

  40. [49]

    End-to- End Secure Mobile Group Messaging with Conver- sation Integrity and Deniability

    Michael Schliep and Nicholas Hopper. End-to- End Secure Mobile Group Messaging with Conver- sation Integrity and Deniability. In Lorenzo Cav- allaro, Johannes Kinder, and Josep Domingo-Ferrer, editors,Proceedings of the 18th ACM Workshop on Privacy in the Electronic Society, W...

    2019

  41. [50]

    Is Bob Sending Mixed Signals? In Bhavani Thuraising- ham and Adam J

    Michael Schliep, Ian Kariniemi, and Nicholas Hopper. Is Bob Sending Mixed Signals? In Bhavani Thuraising- ham and Adam J. Lee, editors,Proceedings of the 2017 on Workshop on Privacy in the Electronic Society, Dal- las, TX, USA, October 30 - November 3, 2017, pages 31–

    2017

  42. [51]

    The Messaging Layer Security (MLS) Extensions

    Raphael Robert. The Messaging Layer Security (MLS) Extensions. Internet-Draft draft-ietf-mls-extensions-08, Internet Engineering Task Force, July 2025. Backup Publisher: Internet Engineering Task Force Num Pages:

    2025

  43. [52]

    URL: https://datatracker.ietf.org/doc/dr aft-ietf-mls-extensions/08/

  44. [53]

    New Features Coming to Signal Groups, October 2020

    Signal Messenger. New Features Coming to Signal Groups, October 2020. URL: https://signal.org/ blog/new-groups/

    2020

  45. [54]

    More is Less: On the End-to-End Security of Group Chats in Signal, WhatsApp, and Threema

    Paul Rösler, Christian Mainka, and Jörg Schwenk. More is Less: On the End-to-End Security of Group Chats in Signal, WhatsApp, and Threema. In2018 IEEE European Symposium on Security and Privacy, Eu- roS&P 2018, London, United Kingdom, April 24-26, 2018, pages 415–429. IEEE, 20...

    2018

  46. [55]

    libsignal- protocol-java: A Java implementation of the Sig- nal Protocol, 2022

    Signal Technology Foundation / signalapp. libsignal- protocol-java: A Java implementation of the Sig- nal Protocol, 2022. URL: https://github.com/si gnalapp/libsignal-protocol-java

    2022

  47. [56]

    Signal-Android: Commit 0459d118a397e5405c9742e3f6238189e1fe0c9d

    signalapp. Signal-Android: Commit 0459d118a397e5405c9742e3f6238189e1fe0c9d. Accessed: 2026-02-05. URL: https://gi thub.com/signalapp/Signal-Android/commi t/0459d118a397e5405c9742e3f6238189e1fe0c9d

    2026

  48. [57]

    URL: https://www-users.cse.umn

    ACM, 2017. URL: https://www-users.cse.umn. edu/~hoppernj/mixed_signals_wpes17.pdf, doi: 10.1145/3139550.3139568

    2017

  49. [58]

    Vasserman, and Nicholas Hopper

    Michael Schliep, Eugene Y . Vasserman, and Nicholas Hopper. Consistent Synchronous Group Off-The- Record Messaging with SYM-GOTR.Proc. Priv. Enhancing Technol., 2018(3):181–202, 2018. URL: https://doi.org/10.1515/popets-2018-0027, doi:10.1515/POPETS-2018-0027

    2018 doi

  50. [59]

    Signal » Home

    Signal. Signal » Home. Accessed: 2026-01-27. URL: https://signal.org/

    2026

  51. [60]

    RemoteConfig.kt at commit 1ddde6a inSignal-Android, 2026

    signalapp. RemoteConfig.kt at commit 1ddde6a inSignal-Android, 2026. Ac- cessed: 2026-02-05. URL: https://gi thub.com/signalapp/Signal-Android/blob/ 1ddde6ab92f39dff0987f60a08460412a0879a55/ app/src/main/java/org/thoughtcrime/secur esms/util/RemoteConfig.kt#L547-L563

    2026

  52. [61]

    Group chats

    Signal Support. Group chats. Accessed: 2026-01-27. URL: https://support.signal.org/hc/en-us/ar ticles/360007319331-Group-chats

    2026

  53. [62]

    Threema for iOS: Larger Groups and More

    Threema. Threema for iOS: Larger Groups and More. Accessed: 2026-01-27. URL: https://threema.com/ en/blog/threema-464-for-ios

    2026

  54. [63]

    Threema Poll Feature

    Threema. Threema Poll Feature. Accessed: 2026- 01-27. URL: https://threema.com/en/blog/thr eema-poll-feature

    2026

  55. [64]

    GroupSendEndorsement.ts at commit 85686ca inlibsignal, 2025

    signalapp. GroupSendEndorsement.ts at commit 85686ca inlibsignal, 2025. Ac- cessed: 2026-02-05. URL: https://gi thub.com/signalapp/libsignal/blob/ 85686caa01465eacba6fddcdc19a22d2d62d8c7f/ node/ts/zkgroup/groupsend/GroupSendEndor sement.ts

    2025

  56. [65]

    IncomingMessage.java at com- mit dc3920a inSignal-Server, 2025

    signalapp. IncomingMessage.java at com- mit dc3920a inSignal-Server, 2025. Ac- cessed: 2026-02-04. URL: https://gi thub.com/signalapp/Signal-Server/blob/ dc3920a99cb25cae66ca7439004545b69ae55ca4/ service/src/main/java/org/whispersystems/ textsecuregcm/entities/IncomingMessage....

    2025

  57. [66]

    MessageController.java at com- mit ad21f00 inSignal-Server, 2026

    signalapp. MessageController.java at com- mit ad21f00 inSignal-Server, 2026. Ac- cessed: 2026-02-05. URL: https://gi thub.com/signalapp/Signal-Server/blob/ ad21f002ab837f931c28a5ea020d82eb0b1f43aa/ service/src/main/java/org/whispersystems/ textsecuregcm/controllers/MessageCont...

    2026

  58. [67]

    SoK: Secure Messaging

    Nik Unger, Sergej Dechand, Joseph Bonneau, Sascha Fahl, Henning Perl, Ian Goldberg, and Matthew Smith. SoK: Secure Messaging. In2015 IEEE Symposium on Security and Privacy, SP 2015, San Jose, CA, USA, May 17-21, 2015, pages 232–249. IEEE Computer Society, 2015.doi:10.1109/SP.2015.22

    2015 doi

  59. [68]

    Secure Communication For Individuals and Companies

    Threema. Secure Communication For Individuals and Companies. Accessed: 2026-01-27. URL: https:// threema.com/en

    2026

  60. [69]

    WhatsApp Encryption Overview: Tech- nical white paper

    Whatsapp. WhatsApp Encryption Overview: Tech- nical white paper. Technical report, September

  61. [71]

    Cryptography Whitepaper

    Threema. Cryptography Whitepaper. Tech- nical report, March 2025. Accessed: 2026-01-

    2025

  62. [72]

    URL: https://threema.com/press-files/2_ documentation/cryptography_whitepaper.pdf

  63. [73]

    Threema-Info.plist at commit 7b1636e inthreema-ios, 2025

    threema-ch. Threema-Info.plist at commit 7b1636e inthreema-ios, 2025. Accessed: 2026- 01-29; iOS app source file from the Threema open-source repository. URL: https://gi thub.com/threema-ch/threema-ios/blob/ 7b1636e9a1e765f6aa1db7a71420c4d3874b0ca5/ Threema/SupportingFiles/Thr...

    2025

  64. [74]

    Randomized Byzantine Agreements

    Sam Toueg. Randomized Byzantine Agreements. InProceedings of the Third Annual ACM Sympo- sium on Principles of Distributed Computing (PODC ’84), pages 163–178, Vancouver, British Columbia, Canada, 1984. Association for Computing Machinery. URL: https://dl.acm.org/doi/10.1145/8...

    1984

  65. [76]

    Secure and Reliable Free Private Messaging and Calling

    WhatsApp. Secure and Reliable Free Private Messaging and Calling. Accessed: 2026-01-27. URL: https:// www.whatsapp.com/

    2026

  66. [79]

    No ordering constraint is imposed on messages originating from different senders

    Per-Speaker FIFO Order:For any two messages m1,m 2 such that snd(m1) =snd(m2) and seq(m1)<seq(m 2), if m1 precedes m2 in Tri for some honest participant i, then m1 precedes m2 in Trj for every honest participant j. No ordering constraint is imposed on messages originating from...

  67. [80]

    Causal Order Agreement:For any two messages m1,m 2 such that m1 →m 2, if m1 →m 2 in Tri for some hon- est participant i, then m1 →m 2 in Trj for every honest participant j. This definition of TC captures a form of causal ordering of messages: If a message m1 was received befor...

  68. [368]

    ACM, 2009.doi:10.1145/1653662.1653705

    2009

  69. [2014]

    URL: https://signal.org/blog/private- groups/

  70. [2023]

    A Appendix A.1 Defining Transcript Consistency The ambiguous use of the termtranscript consistency, e.g

    URL: https://www.whatsapp.com/securi ty/WhatsApp-Security-Whitepaper.pdf. A Appendix A.1 Defining Transcript Consistency The ambiguous use of the termtranscript consistency, e.g. in the context of MLS where it is only referring to group state [13, 16, 47], as well as the vario...

  71. [9420]

    URL: https://www.rfc-editor.org/info/r fc9420,doi:10.17487/RFC9420

    doi

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.