Sending an encrypted note, and who it actually excludes

You encrypt a message to the vendor's key and send it through the platform. The platform now holds something it cannot read. Everything else about the message is unchanged.

Encryption between two parties does one specific thing. It divides the people who can see that a message exists from the people who can read what it says. Both groups still exist. The groups are just no longer the same.

That is the whole mechanism, and most confusion about it comes from expecting a second effect that is not there.

What changes: the platform stops reading

Without encryption the platform holds your text. It is a field in a store, alongside every other message in every other conversation, subject to whatever retention the operators chose and whatever happens to that store later.

With encryption the platform holds ciphertext. It can move it, store it, back it up and hand it on, and none of those operations produce your words. If the store is read at some future point by anyone at all, what is read is ciphertext. That is a genuine and durable change, and it is the reason the mechanism is worth using at all.

What it does not do is remove the message from the platform. The message is still there. It is still yours, still addressed, still timed. The market inbox card covers the store from the platform's side.

What does not change: the recipient reads everything

A message encrypted to a key is a message intended for whoever holds that key. Reading it is not a failure of the system. It is the system working.

This sounds obvious written down, and it is regularly forgotten in practice, particularly when the message contains an address. The address you hand over exists as a separate card because that specific confusion is the most consequential one in the catalogue. Encrypting an address protects it from the carrier. It hands it to the recipient, which was the entire purpose of writing it.

What happens after decryption is outside the mechanism altogether. The plaintext exists on the recipient's machine at least momentarily, and what becomes of it is a question about a person's habits, not about cryptography.

What the carrier still sees

Content is one attribute of a message. It is not the only one, and the others are not covered by encrypting the body.

• That a message was sent at all.
• Which account sent it.
• Which account received it.
• The exact time.
• The approximate size, which loosely tracks length.
• How often the two accounts exchange messages, and in what rhythm.
• That the message is encrypted, which is itself a visible property.

A conversation with the content stripped out is still a conversation. Who talks to whom, how often and when is a considerable amount of structure. Nothing in the ordinary use of encryption on a platform hides it, because the platform has to route the message and cannot route what it cannot address.

The key you used is itself an identifier

Encrypting requires a key, and a key is a distinct object with a distinct fingerprint. Two things follow from that, and they pull in opposite directions.

The first is that using a key proves you had it. That is the useful property, and it is what makes a key more than a lock.

The second is that a key reused across accounts links those accounts to each other, to anyone who can see both. This is the same shape as the writing style problem in asking a question first, but harder edged, because a fingerprint is exact where a style is only suggestive. A handle can be discarded in seconds. A key that has been used in several places has already done its linking.

The recipient's key is an identifier too. Which key you encrypted to says which vendor identity you were writing to, and that is visible to anyone who can see the ciphertext and knows the key.

Three readers, one message

The last row is a reminder that the network observers are a different problem entirely, described in the shape and size of the traffic. They were never reading the message in the first place, so encrypting it changes nothing for them.

What changes the answer

5 things change how much this action gives away. None of them takes it to zero, and none of them is a promise.

1. Encrypting removes exactly one readerThe carrier. That is the change. Naming it precisely is more useful than a general sense of being protected, because it makes clear which risks are untouched.
2. Metadata is unaffectedSender, recipient, timing, frequency and size stay visible to the platform. If the pattern of a conversation matters to you, encryption is not the mechanism that addresses it.
3. Key reuse links accountsA fingerprint used in two places joins them. This is a description of how public key material works, not a suggestion about what anyone should do with theirs.
4. Plaintext exists on both endsYours before sending, theirs after reading. Your end is covered in what lands on the disk and copying an address to the clipboard. Their end is not visible to you at all.
5. The content is protected, the fact of contact is notTwo accounts that message each other weekly have a legible relationship regardless of what the messages say.

What this card is not

This card does not explain how to set up or use any particular encryption tool, and it makes no claim about how well any specific implementation works.

Questions that come up

If the platform cannot read it, is the message private?

It is private from the platform. It is not private from the recipient, who was always meant to read it, and the fact that you sent it remains visible to the platform.

Does encrypting hide who I am writing to?

No. Routing requires a recipient, so the recipient is in the clear. Only the body is protected.