And the networks on both the sender's and receiver's side keep a copy of the messages for a certain time. Depending on local data retention laws, these may then be kept for some mandatory longer period.

It's a good idea to assume that texts are stored forever. There's no technical reason to remove ~140 bytes of data when storage is cheap.

Your local data retention laws and the network's practices may vary or they may be under pressure from law enforcement to keep things longer than necessary. They will not disclose in public how long they are stored, so better assume forever.

Especially when that 140 bytes is text, one of the most compressible forms of data

and the networks also keep more than just the messages: they keep the location the phones where at when sending and receiving the messages. and the locations of any other phones nearby, at the same time.

That much you can protect against with end-to-end encryption.

In fact, it's a lot easier these days to assume that what you broadcast through any medium is archived, you're on video and audio. You're not always, but it's easier to work on that assumption than accurately figure out when you really are.

Disclaimer: Statement obviously does not apply outside of Canada, US, UK, etc.

Another forgotten truth: most chat apps don't use end-to-end encryption by default, and the majority of the few that do, don't self-destruct the messages (you hear that Signal/Whatsapp teams?!).

Self-destructing messages are security theatre with no guarantee that it's actually happened, I believe that was Moxie's answer when that was last asked. From what I recall, anyway!

He's wrong, oddly. For many scenarios, Signal would be better off if it offered a timer. After all, it offers a count-based deletion system (delete messages when conversation > X msg).

The only issue is in pretending this removes the message from the other side (like Telegram). Bury it in advanced options, put up a big warning or whatever. But to say people will get too confused and think it magically deletes other people's data ... that's a poor deal for serious users.

As-is, Signal users must diligently wipe information in case they are, for instance, stopped by police. Or in any other situation where they might be deprived of access for a bit, then be compelled to open the device. Perhaps they were in the middle of talking to someone. With a 1-5 minute timer, Signal can be useful enough to chat, while not risking too much if it's forcefully removed from you.

It's also just good hygiene in general. Most people are probably better off having old data get wiped automatically some time later. Opt in to perma-save. It's not comprehensive, but it sure helps users avoid an accidental disclosure.

And no, length limits are not good enough since they span an arbitrary amount of data and time. In fact, I'm not even sure of the point, unless it's to speed up the UI or something.

The Compartmented Mode Workstations with all their security features weren't rated to stop skilled hackers. So, what where the restrictions for? Answer: to prevent users from inadvertantly screwing up their own security plus make casual attackers work for it a bit. Making stuff automatically disappear unless you mark it permanent automatically reduces the amount of stuff someone will get from snatching your phone. That's why it's a good idea.

Side effect: may reduce information overload or search time for important messages. Unproven. Just a guess.

Guaranteed self-destructive messages, readable by human senses (and therefore cameras and microphones), are not possible.

Wickr

On top of it not disproving the rule, it's a bad reply for a number of reasons:

https://maqp3d.wordpress.com/2015/10/03/wickr/

Yikes.