Security
How Nossic Talk keeps your messages private
In plain words: what end-to-end encryption means here, what it protects, and what our server can still see. We'd rather you knew the limits than assumed there weren't any.
The short version
Your messages and files are locked on your device and only unlocked on the devices of the people you're talking to.
- Keys live on your devices. Each browser you sign in on makes its own keys. They're never sent to us.
- The server only stores ciphertext. Messages, files and file names reach us already encrypted, and stay that way.
- You can check who you're talking to. Verify your own devices and your colleagues', so an unexpected device stands out.
- A recovery key brings your history back. It's yours alone. We can't use it, and we can't reset it for you.
Keys on your devices
When you sign in on a browser for the first time, it creates a set of encryption keys. The private halves stay in that browser's storage. Your other devices, and your colleagues', learn only the public halves, which are safe to share.
Nossic Talk uses the encryption from the open Matrix standard: Olm to set up a private channel between two devices, and Megolm to encrypt messages in a room. We use the open-source Rust implementation maintained by the Matrix project, running inside your browser. We didn't invent any cryptography of our own.
The server only stores ciphertext
When you send a message, your browser encrypts it for the devices of everyone in the room before it leaves. Files work the same way: each file gets its own key, is encrypted on your device and uploaded as scrambled data; the key travels inside the (encrypted) message. The file's name is in that encrypted message too.
So our server, our database and our backups hold ciphertext: data that's useless without keys we don't have. That's also why search runs on your device: there's nothing readable on the server to search.
Device verification
Encryption is only as good as knowing whose keys you're using. Nossic Talk uses Matrix cross-signing: you confirm a new device of yours from one you already trust (or with your recovery key), and you can verify a colleague once, in person or over a call, by comparing a short code on both screens. After that, their new devices are trusted when they verify them, and any device that isn't verified is clearly marked.
Recovery key
Your keys are on your devices, so what happens if you lose them all? When you set up Nossic Talk you get a recovery key. Your message keys are backed up to our server encrypted with it, so we store the backup but can't open it.
Keep your recovery key somewhere safe, like a password manager. If you lose every device and the recovery key, your old messages can't be recovered by anyone, including us. That's the price of nobody else holding a spare key.
What our server can see
End-to-end encryption hides what you say, not everything about how you use the service. To deliver messages, our server has to know some things. Here they are.
| What | Why the server needs it |
|---|---|
| Who is in which room | To know whose devices should get each message, and who may join. |
| When messages are sent | Timestamps put messages in order and drive notifications. |
| How big messages and files are | The server stores them, so it knows their size (not what's in them). |
| Room names, topics and pictures | In Matrix these are room settings stored unencrypted, so choose names you'd be happy for us to see. |
| Your name, profile picture and organisation | From your Nossic ID and Nossic Accounts, so colleagues can find you. |
| Which message a reply or reaction belongs to | The link between messages is visible so they can be shown together; the content isn't. |
| Read receipts and typing notices | Sent through the server unencrypted, as in Matrix generally. |
| Your devices, IP addresses and sign-in times | To keep your account secure and let you sign out lost devices. |
How long we keep this, and your rights over it, are in the Nossic privacy notice.
What encryption can't do
- It can't protect a device that's been taken over. Malware on your computer, or someone with your unlocked laptop, can read what you can read.
- It can't stop the people in a room. Anyone who can read a message can copy it, screenshot it or forward it.
- The web app comes from our server. In a browser you're trusting us to send you the genuine Nossic Talk code each time. Phone and desktop apps, when they come, will be signed and installed like any other app.
Found a security problem? Tell us through nossic.uk and we'll look into it straight away. Please don't test against other people's accounts.