Week 6: Private Messaging, Encrypted Email, and Metadata Hygiene

🎯 Goal

Learn how to communicate securely using end-to-end encrypted messaging, GPG-encrypted email, and metadata minimization. Explore Signal, Matrix, OTR, and email tools. Understand operational privacy trade-offs.

🌱 New to this? If the command line feels like a lot, Privacy 101 walks through secure messaging with Signal in a graphical, beginner-friendly way first: Privacy 101 Week 6: Secure Messaging →

1. Secure Messaging Protocols Overview

2. Signal CLI Setup

Install signal-cli

signal-cli is not in the official Debian or Ubuntu repositories. Download the latest release tarball from https://github.com/AsamK/signal-cli/releases, extract it (for example under /opt), then symlink the binary into /usr/local/bin. The standard build runs on the JVM and needs a recent JRE; a native build exists only for some platforms. Some distros and community repos do package it.

Project page: https://github.com/AsamK/signal-cli

📱 Register Your Number (Use Burner SIM or VoIP)

Registering a number this way unregisters any Signal app already using that number. If you want to keep your phone, skip to “Link Instead” below.

Signal almost always asks for a captcha. Get a token from https://signalcaptchas.org/registration/generate.html, copy the full signalcaptcha://... string, and pass it in single quotes:

signal-cli -a +1234567890 register --captcha 'signalcaptcha://...'

Verify the Code

Registration isn’t finished until you enter the code Signal sends you:

signal-cli -a +1234567890 verify 123-456

Link Instead (Keep Your Phone)

signal-cli link -n "cli"

signal-cli prints a device-link URI. Show it as a QR code and scan it from the Signal app on your phone to add signal-cli as a linked device.

Send a Message

signal-cli -a +1234567890 send -m "Cypherpunk test message" +10987654321

Receive Messages

signal-cli -a +1234567890 receive

🛰 3. Matrix + Element (Or CLI Clients)

✅ Choose a Homeserver

• Use a privacy-respecting instance or self-host (e.g. matrix.org, tchncs.de, envs.net)
• Register with Element or another client of your choice

CLI Matrix Clients

• gomuks: terminal-based, fast
• weechat + matrix plugin: customizable IRC-style UI
• nheko: GUI, encrypted room support

3b. XMPP + OTR Setup (Self-Hosted Option)

Why XMPP + OTR?

• Decentralized: Run your own server or use trusted providers
• OTR (Off-the-Record): Perfect forward secrecy, deniability
• Lightweight: Works over Tor, low bandwidth
• Privacy: No phone number required, pseudonymous

Install Profanity (Terminal XMPP Client)

sudo apt install profanity

Or build from source: https://profanity-im.github.io

Create XMPP Account

Option 1: Use existing provider

• conversations.im (privacy-focused)
• disroot.org (activist-friendly)
• 404.city (Tor-friendly)

Option 2: Self-host with Prosody

sudo apt install prosody

Configure Profanity with OTR

profanity

Inside Profanity:

/account add [email protected]
/connect [email protected]
/otr gen

To use a short account name instead: /account add myaccount, then /account set myaccount jid [email protected], then /connect myaccount.

Start OTR Session

/msg [email protected]
/otr start

Verify fingerprints:

/otr question "What is our secret word?" answer

OTR vs OMEMO

Use OMEMO by default: multi-device, offline messages, group chats, wide client support (Conversations app). In Profanity: /omemo gen, then /omemo start. Use OTR for: 1-on-1 conversations between two people who are both online at a desktop, lightweight

4. Encrypted Email with GPG + CLI

📨 Install mutt or neomutt

sudo apt install mutt

Configure Mail Account in .muttrc

Basic config:

set from = "[email protected]"
set realname = "Anon"
set smtp_url = "smtp://[email protected]@smtp.mailserver.com:587/"
set smtp_pass = "your_password"

A plaintext password in a dotfile is readable by anything running as you: chmod 600 ~/.muttrc, keep it out of any repo, and for better security load the password from an encrypted file, e.g. source "gpg -dq ~/.mutt/pass.gpg |" where pass.gpg holds set smtp_pass="...".

Enable GPG in Mutt

set crypt_use_gpgme = yes
set crypt_autosign = yes
set crypt_replyencrypt = yes
set crypt_replysign = yes

Encrypt and Send an Email

Compose a message with m in mutt’s index. In the compose screen, press p to open the security menu, then e to encrypt (or b to sign and encrypt). Press y to send. Note that s in the compose screen edits the subject.

Make sure the recipient’s public key is imported:

gpg --import keys/their_pubkey.asc

4b. Email Aliases & Identity Compartmentalization

Why Email Aliases?

• Prevent tracking across services
• Isolate identities (work, personal, activist, shopping)
• Easy to burn/delete compromised addresses
• Reveal who leaked or sold your data

SimpleLogin (Open Source, Self-Hostable)

Service: https://simplelogin.io

Features:

• Unlimited aliases (premium)
• Reply from alias
• PGP encryption support
• Open source, can self-host

Setup:

1. Create SimpleLogin account
2. Generate alias: [email protected]
3. Forward to your real email
4. Reply from alias (preserves compartmentalization)

Addy.io (Alternative, formerly AnonAddy)

Service: https://addy.io

Features:

• Similar to SimpleLogin
• Can use custom domains
• Encrypted forwarding
• Self-hostable (based on Laravel)

Burner Email for Signups

Guerrilla Mail: https://www.guerrillamail.com

• Temporary, disposable
• No signup required
• Good for one-time verifications

10 Minute Mail: https://10minutemail.com

• Self-destructs after 10 minutes
• Can extend if needed

CLI Email Alias Management

With SimpleLogin API:

curl -X POST -H "Authentication: YOUR_API_KEY" \
  -H "Content-Type: application/json" -d '{}' \
  "https://app.simplelogin.io/api/alias/random/new?hostname=example.com"

This fits into a password manager workflow.

🛡 5. Metadata Hygiene

🧹 Remove File Metadata

Install mat2:

sudo apt install mat2

Clean a file:

mat2 secret.pdf

This writes secret.cleaned.pdf and leaves secret.pdf untouched, so share the .cleaned file (or use mat2 --inplace secret.pdf, which overwrites without a backup). Verify with mat2 --show secret.cleaned.pdf.

Supports: PDFs, images, Office files, audio, video

Check for EXIF Data in Images

exiftool image.jpg

Strip metadata:

exiftool -all= image.jpg

exiftool keeps the original as image.jpg_original. Add -overwrite_original to skip the backup, or delete the _original file before sharing.

5b. When to Use Which Messaging Protocol

🧭 Protocol Selection Flowchart

START HERE:

Do you need to contact non-technical people?

• YES → Signal (easiest onboarding, strong E2EE)
• NO → Continue

Is anonymity critical (no phone number)?

• YES → XMPP + OTR or Matrix (pseudonymous)
• NO → Continue

Do you need group chats and multi-device?

• YES → Matrix (federated, modern features)
• NO → XMPP + OTR (1-on-1, lightweight)

Do you need it to work over Tor with high latency?

• YES → XMPP + OTR (low bandwidth, works on slow connections)
• NO → Signal or Matrix work fine

Do you need true P2P (no servers)?

• YES → Tox (completely decentralized, NAT traversal)
• NO → Any of the above

🎯 Real-World Scenarios

Scenario 1: Journalist Contacting Source

• Use: Signal (if source is non-technical) or XMPP + OTR (if source is technical)
• Why: E2EE mandatory, disappearing messages, screenshot protection
• Setup: Burner phone number + VoIP for Signal, or pseudonymous XMPP account

Scenario 2: Activist Coordination Group

• Use: Matrix (Element) on private homeserver
• Why: Group chat, federation, self-hosting = control
• Setup: Rent VPS with cryptocurrency, deploy Synapse server, invite-only rooms

Scenario 3: Privacy Researcher Collaboration

• Use: XMPP + OTR (1-on-1) or Matrix (group)
• Why: Metadata-resistant, Tor-friendly, technical users
• Setup: Use Tor hidden service XMPP server, verify OTR fingerprints via separate channel

Scenario 4: Family Group Chat

• Use: Signal
• Why: Easy for non-technical users, still E2EE
• Setup: Standard Signal registration, educate family on security pins

⚠️ What NOT To Use

❌ WhatsApp - Owned by Meta, metadata collection, closed source ❌ Telegram - Not E2EE by default, secret chats are but group chats aren’t ❌ Discord - No E2EE, server logs everything ❌ Slack - Enterprise owns all data, no E2EE, compliance logging ❌ SMS - Plaintext, easily intercepted, SS7 attacks

🔀 Metadata Comparison

Mitigation: Use Tor for all protocols, use burner identities, rotate accounts

🕳 6. Plausible Deniability & Hidden Volumes

Key Concepts

• Deniability: Can you prove you do not have the key to something?
• Hidden volumes: VeraCrypt supports hidden volumes. LUKS does not, and a LUKS header is identifiable unless you use a detached header or plain dm-crypt mode. Tomb has no hidden volumes, but tomb bury can hide its key file inside an image.
• Operational strategies: Use fake decoy accounts, nested keys, delay unlocks

Tools to Explore

• veracrypt hidden volumes
• tomb + gpg hidden keys
• Live OS (e.g. Tails, Whonix) with RAM-only operation

7. Journal & Git Commit

Reflect on Week 6

echo "Week 6: Practiced private messaging with Signal, Matrix, and XMPP+OTR. Set up email aliases for compartmentalization. Learned protocol selection based on threat models. Configured encrypted email workflows." >> notes/week6_journal.md

Git Commit

git add .
git commit -S -m "Week 6 - Secure messaging, XMPP+OTR, email aliases, protocol selection"

✅ Week 6 Checklist

• Sent and received messages with Signal CLI
• Chose a Matrix homeserver and registered with a client (Element or a CLI client such as gomuks)
• NEW: Set up XMPP + OTR with Profanity client
• NEW: Created email aliases with SimpleLogin or AnonAddy
• NEW: Learned protocol selection based on threat model
• Configured mutt for encrypted email with GPG
• Practiced metadata removal with mat2 and exiftool
• Explored hidden volumes and plausible deniability concepts
• Journaled and made signed Git commit

🔜 Up Next: Week 7 Preview

• Tor architecture: How anonymity networks actually work
• Tor Browser setup and operational security
• Running Tor relays and bridges
• Onion services: Hosting .onion sites
• Tor pitfalls and when NOT to use Tor

Notes

• Assume any central service (Signal, Matrix, etc) logs metadata
• Email aliases prevent cross-service tracking - use unique alias per service
• Protocol choice depends on threat model - convenience vs anonymity vs features
• Signal provides best UX, Matrix provides best flexibility
• Use burner SIMs, disposable email, and random usernames
• Strip metadata before sharing any files or screenshots
• Hidden volumes and RAM-only OSes can protect against coercion
• Test your messaging setup over Tor to ensure it works under network restrictions