That assumes you can trust 1) the (proprietary) application on the recipient's end to delete the message, 2) the recipient to not save the message some other way, and 3) the opaqueness of the protocol preventing anyone from writing a replacement client that doesn't delete messages.

There's no way to guarantee deletion; if the recipient can read it, the recipient can save it.

In the end it will always come down to the 'analog hole' - no matter how airtight the digital implementation, you'll never stop the user at the other end from taking a photo of the screen.

Not an analog photo, no. However, an airtight digital implementation would absolutely do stop anyone from recording anything they're not allowed to record -- and it wouldn't be really airtight if ownership of non-aligned equipment was tolerated :P

Can we trust Wickr? I have used it for some communications I would not like to get to wrong hands (but the consequences of getting lost are not too harsh), yet I have roughly zero confidence that the messages aren't stored and that they are delivered end-to-end secure.

It's not open source (?) so it can't be audited. The server infrastructure may be wiretapped and/or backdoored by law enforcement together with a gag order. It's headquartered in the US, which I don't trust. They claim to be end-to-end encrypted but how can I tell, let alone the general public who aren't familiar with crypto.

I've used Wickr because the other parties I was communicating with were using it. But since I wasn't trusting the other party (cryptography can only assure trust, not create it) so I might have been using smoke signals instead.

For my use, it still does beat text messages because at worst it's security by obscurity and my local (non-US) law enforcement can't easily get their hands on the data.

I never stated I trusted Wickr to not be backdoored. Just that it would be better than a text message.

That depends on the adversary.

For something I don't want to get into the hands of local law enforcement (outside US), Wickr might be better than text messages.

But I trust my network provider more when it comes to keeping the data safe, if I don't mind that local LEO agencies can readily access it. They are under strong legal and contractual obligations not to disclose the information to third parties and have better funding than Wickr.

Wickr probably does a pretty good job, but they might be backdoored (ie. keep plaintext of communications and/or metadata) and might get hacked and leak the data and release it in the internet.

It is interesting that the aides's solution is similar (BlackBerry instant messages) which, apparently, RIM does not archive (though I'll bet the Canadian CSE does).

An interesting property of BBM is that organisational policy can be enforced for message deletion. It is not implausible that future iphones will have to supply some proof of being un-tampered before being allowed to join Apple's overlay network.

In the short term, switch to Signal or WhatsApp, and don't send anything naughty. Have a scheduled deletion policy written down and follow it.