Open leomira opened 11 months ago
Now thinking about this more, I think the correct approach is not to have a canary, but to just reiterate that our servers do not contain any personal info in unencrypted state so it does not really matter.
What data do you have? With the data that you have, is it possible to know that a phone number (an user) has contacted another phone number (another user), even if the messages are encrypted? Which data are only on the phone? Which data are sent to your server in encrypted and clear way? I think that what it is written on the website it isn't specified and clear enough.
It is not possible to find out which numbers (users) connected with whom. Nor if they posted an offer, reacted to one, or had a trade going on.
For more information, I recommend checking the code.
Let's implement a Vexl Canary.
I would do it the same way as Trezor does.
https://trezor.io/transparency/canary.txt