We're relying on them not being successfully compelled to retain that metadata -- which is a significantly different proposition.

No, not really - they can decide at any time to start storing that metadata of their own will, use it internally, sell it to advertisers or turn it over via a direct law enforcement portal if they want. Their access alone is in many ways a problem.

Of course, we are agreeing. But as the other front page story shows us, even companies with the best of intentions and made up of people with strict moral codes devoted to providing their users a secure product can be usurped by government forces with ulterior motives.

I believe Whisper doesn't want this data. I can even trust that they would never collect it of their own volition. But it's irrelevant if they can simply be compelled to collect it, or even worse, someone within their organization can be compelled to secretly collect it and may even do a better job at this secret collection than Mayer's lackies at Yahoo!.

How would they be able to do that? Can you quote where in the article you got that and how that would happen?

"Notably, things we don't have stored include anything about a user's contacts (such as the contacts themselves, a hash of the contacts, any other derivative contact information), anything about a user's groups (such as how many groups a user is in, which groups a user is in, the membership lists of a user's groups), or any records of who a user has been communicating with."

If they don't store the contacts, or even a hash of the contact, how can you figure out who was talking to who?

Yes, but zeveb makes the following points:

1. "the contacts, or even a hash of the contact" are being not stored by choice rather than by necessity.

2. If OWS chose to start storing these metadata in the future, they could.

3. A protocol where the metadata could not be stored intrinsically would be preferable.

> If they don't store the contacts, or even a hash of the contact, how can you figure out who was talking to who?

Think of it like email. The body is encrypted, the subject is encrypted, any attachments are encrypted, but in order for them to route the message to the correct destination every message you send still has a "To:" field - their server still decides who to send the notification to.

They don't need to read the contacts or anything of the sort - they just read the "To:" field.