{"action":"created","issue":{"url":"https://api.github.com/repos/WhisperSystems/TextSecure/issues/1764","labels_url":"https://api.github.com/repos/WhisperSystems/TextSecure/issues/1764/labels{/name}","comments_url":"https://api.github.com/repos/WhisperSystems/TextSecure/issues/1764/comments","events_url":"https://api.github.com/repos/WhisperSystems/TextSecure/issues/1764/events","html_url":"https://github.com/WhisperSystems/TextSecure/issues/1764","id":39145284,"number":1764,"title":"Enable sender to delete own messages from all parties in the conversation","user":{"login":"jooize","id":719371,"avatar_url":"https://avatars.githubusercontent.com/u/719371?v=3","gravatar_id":"","url":"https://api.github.com/users/jooize","html_url":"https://github.com/jooize","followers_url":"https://api.github.com/users/jooize/followers","following_url":"https://api.github.com/users/jooize/following{/other_user}","gists_url":"https://api.github.com/users/jooize/gists{/gist_id}","starred_url":"https://api.github.com/users/jooize/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jooize/subscriptions","organizations_url":"https://api.github.com/users/jooize/orgs","repos_url":"https://api.github.com/users/jooize/repos","events_url":"https://api.github.com/users/jooize/events{/privacy}","received_events_url":"https://api.github.com/users/jooize/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/WhisperSystems/TextSecure/labels/feature","name":"feature","color":"02d7e1"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2014-07-30T22:45:40Z","updated_at":"2015-03-04T21:51:31Z","closed_at":null,"body":"While I think this is an important feature, some people were opposed to self-destructing messages. I would take it even further and do similar to [Gliph](https://gli.ph/), where anyone in a conversation can delete messages. A risk with Gliph is their effectively central control*, which the TextSecure team seems to have solved very elegantly.\r\n\r\n_\\* Gliph is quite [transparent](https://gli.ph/privacy.html), and have what they call [Lockdown™ Privacy Protection](https://blog.gli.ph/2012/05/31/introducing-gliph-app-version-1-2-powerful-privacy-for-iphone/). Unfortunately, the fact remains they are in control of the infrastructure and could theoretically capture the passphrase next time you login. Meaning we have to trust them._\r\n\r\n> Messages I send other people should disappear on my terms. The sender should have control over her messages, as she's the one providing the content after all.\r\n\r\nWithout much insight into the project, I'd like to share my ideas. Let's hope they are of value.\r\n\r\n# Scenarios to relate with\r\nImagine two journalists discussing some political issue over TextSecure, and one of them loses track of their phone. Say this journalist didn't care immensely and neglected security in a way that his messages are now available to read for anyone in possession of his phone. If the journalist's friend could trigger the phone to delete sensitive messages—provided the phone can reach the Internet—they could rest more peacefully.\r\n\r\n**In case you are not a top secret agent**, something easier to relate to may be sending a message to the wrong person. If you realize you've sexted your family like around 10% in a [poll by Recombu](http://recombu.com/mobile/news/half-of-uk-adults-have-sent-a-sext-one-in-10-to-the-wrong-person_M17564.html) have you may want to have an undo button. (how do people accidentally do this?)\r\n\r\n# Friends and collegues\r\nI care quite a bit about privacy and security, and although I've managed to make my friends care more than expected, there is a limit to what they'll endure. This suggestion would ease the pressure on them to control their habits. They won't use a very secure password if they have to enter it every time to read messages.\r\n\r\n# Implementation complicatedness\r\nPutting this idea together into the product can get complicated. Should the recipient have the ability to disallow deletion? As he could already be in possession of the information, one could argue it may already be captured and that my idea gives a false sense of security to the sender. I think it's an issue with little impact to an otherwise very valuable feature. Anyway, if we let the recipient prevent such deletion, I would like the sender to be aware of that fact before submitting her message.\r\n\r\nIf the recipient doesn't agree with letting the sender delete their messages or having them expire, he could disable it for future messages. The recipient may have the ability to disallow deletion/expiry for (specific or all) senders, but the sender must always be aware of which before sending.\r\n\r\n**All this causes complexity and new UI considerations. It appears we do not want more of that. Everyone should easily understand their message's fate.**\r\n\r\n# Solution\r\n* Let the sender delete it's own contribution to the conversation.\r\n* Allow manual locking of messages as suggested in #283.\r\n\r\nThat's a simple and in my opinion reasonable compromise resulting in an easy to understand model avoiding added complexity.\r\n\r\n## Model\r\nMessages are owned by the sender, who can always delete them, but is also aware that removal from other devices (or human memories) cannot be guaranteed.\r\n\r\n## User interface\r\nWe have the following alternatives for deletion.\r\n\r\nDelete message or conversation...\r\n* ...from current device only.\r\n* ...from current device and send deletion notice for own messages to other parties.\r\n* ...from current device and send deletion notice to other parties, regardless of sender.\r\n* ...from other parties only, by sending a deletion notice.\r\n\r\n## Potential problems\r\nHow can messages be kept track of, and could this kind of ownership break the plausible deniability we currently enjoy? Would the ability to delete any message in a conversation solve that problem?\r\n\r\n## Future considerations\r\n### Let any party delete any message\r\nPeople should manage to handle this as a social issue, where if someone disrespects the wishes of message retention, they're reprimanded appropriately. TextSecure has no role in this.\r\n### Expiring messages (requires UI modification)\r\nPerhaps auto-deletion after recipient specified time period suits better for TextSecure.\r\n\r\n# Related issues\r\n#175, #176, #226, #283.\r\n\r\nI love that Signal was just released for iPhone!"},"comment":{"url":"https://api.github.com/repos/WhisperSystems/TextSecure/issues/comments/77257364","html_url":"https://github.com/WhisperSystems/TextSecure/issues/1764#issuecomment-77257364","issue_url":"https://api.github.com/repos/WhisperSystems/TextSecure/issues/1764","id":77257364,"user":{"login":"ghostbar","id":33868,"avatar_url":"https://avatars.githubusercontent.com/u/33868?v=3","gravatar_id":"","url":"https://api.github.com/users/ghostbar","html_url":"https://github.com/ghostbar","followers_url":"https://api.github.com/users/ghostbar/followers","following_url":"https://api.github.com/users/ghostbar/following{/other_user}","gists_url":"https://api.github.com/users/ghostbar/gists{/gist_id}","starred_url":"https://api.github.com/users/ghostbar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ghostbar/subscriptions","organizations_url":"https://api.github.com/users/ghostbar/orgs","repos_url":"https://api.github.com/users/ghostbar/repos","events_url":"https://api.github.com/users/ghostbar/events{/privacy}","received_events_url":"https://api.github.com/users/ghostbar/received_events","type":"User","site_admin":false},"created_at":"2015-03-04T21:51:31Z","updated_at":"2015-03-04T21:51:31Z","body":"I would like this feature. Is specially useful for political activists in authoritarian countries. Having the ability to avoid torture by writing your password and having no traces of your messages are a good idea.\r\n\r\n(In Venezuela this would be really useful, they force you to show your messages from your devices)"}}