No system protects against everything. This section describes the adversaries Glossia is designed to resist, the risks we have chosen to accept and the limits that no protocol can overcome.
| Adversary | What they can do | What Glossia does |
|---|---|---|
| Network observer near one person | See that the person uses Glossia, and when | Bridges disguise connections; padding hides sizes; content and contacts stay hidden |
| A malicious relay | Drop or delay messages | Routes avoid it next time; it never sees content and never sees both ends |
| Colluding relays | Correlate timing across their relays | Diversity rules keep one operator or country from holding two hops |
| Someone who seizes an unlocked phone | Read what is on it | Disappearing messages and travel mode limit what is there |
| Someone who seizes a locked phone | Very little | Keys are held in the platform’s secure storage |
| Frothly, or anyone who compels Frothly | Nothing useful | Frothly holds no keys; key transparency exposes key swaps |
| A future quantum computer | Break elliptic-curve keys recorded today | The hybrid handshake and post-quantum refresh |
| A global passive observer | Correlate timing across the whole network | Cover traffic and delivery delay make this harder, not impossible |
Accepted risks
- Delivery timing (GL4-L6). When a message is delivered can reveal that a contact is online. Hiding this fully would mean delaying every message for everyone. Clients offer an optional random delay instead.
- Push notifications (GL4-L7). Mobile push services learn when a device receives a message, though not from whom. Clients offer a mode that disables push entirely.
Seized devices
Reference clients offer travel mode, which hides chosen conversations until a passphrase is entered and can be turned on in two taps before a border crossing. Clients keep no message history beyond what the person chooses to keep, and never write decrypted attachments to disk unless the person saves them.
What no protocol can do
Glossia cannot protect a device that is already compromised, a recipient who chooses to share a message, or a conversation held in a room with a microphone in it. It reduces what can be learned from the network to very little. It cannot make the people in a conversation trustworthy. That part is up to them.