Encrypted group Vires
When a group becomes end-to-end encrypted, who can read it, and what Viremail can still see.
A group Vire can be end-to-end encrypted too. Each message is locked on the sender's device for every person in the group, and only they can open it. Viremail carries and stores it, but can't read it.
When a group becomes encrypted
A group becomes end-to-end encrypted with its first message once all of these are true:
- encrypted chats are open for the person sending;
- everyone in the group has turned on encryption;
- the group has at most 256 people.
Until then, the top of the chat says why it isn't, for example "2 people here haven't turned on encryption". Once a group is encrypted it stays encrypted, and a line in the chat shows where that started. Messages from before stay as they were.
Who can read it
Every change to who is in an encrypted group is sealed by the member who makes it, and every member's device checks it. Viremail carries these changes and puts them in order, but it can't add anyone.
- Adding people. Only people who have turned on encryption can be added. A line such as "Asha added Ravi" has a small lock: Asha's device made that change.
- Invite links. An encrypted group's link ends with a secret part after #k=. Your browser never sends that part to Viremail, so share the whole link. Someone who opens it joins, and their device shows everyone else that it had the link. A link without that part, or a group where admins approve people, sends a request instead. Before joining by link or invite, your device checks the keys Viremail shows for people you already know against the ones it has for them, and stops if they differ.
- Invites. When someone's settings mean they get an invite rather than being added straight away, accepting it seals their arrival for the group.
- Removing someone, or leaving. From the next message on, nothing is encrypted for them, and they stop getting new messages and files. Everyone in the group can have the invite link's secret, so removing someone changes the link in the same step: the admin's device makes a new one to share, or, if it can't, Viremail turns the link off. The old link stops working.
- Removed and added back. Your device follows the member list it checked up to your removal. If someone it knew as a member adds you back, or you join again yourself, there's nothing to do.
- New members see messages from when they join. Earlier ones were never encrypted for them, so the setting for what new members can see is fixed in an encrypted group.
- In the group details, each member your device checked shows Confirmed.
Admins are still the people Viremail says they are: they decide who may add people or make links. Encryption makes sure only people a member added, invited or gave the link to can read the group.
Warnings you might see
- "Viremail lists people in this group that nobody here added": Viremail shows someone as a member, but no member added them. Messages to the group are held.
- "This group's member list couldn't be checked": a change to who is here didn't add up or was missing, or a message was sent for a different list of people. Messages are held. You can still read the group.
- "Viremail says Ravi joined. Nobody in the group confirmed it.": a line that only Viremail vouches for.
- "Sent while this group's member list looked different" on a message: it was encrypted for a different list of people than the one your device checked.
- "Eve added you back to this group, but Eve joined while you were out of it": nobody your device knew as a member can vouch for the list you were added back to. Sending waits until you choose Continue. If you don't know Eve, don't send anything there, and check who is in the group.
- Someone's security code changed: they replaced or reset their keys. If you had verified them, sending waits until you compare codes or choose Continue anyway.
If you see a warning you didn't expect, compare security codes with people in the group, and tell an admin.
New devices and resets
A new browser you unlock reads the group's messages from when you joined, and checks the member list against what your other devices saved to your account. After Reset encryption, if nothing is left to check against, your device takes the member list as Viremail shows it at that moment, like the first message to someone new, and the group says so.
What Viremail can still see in a group
| Viremail can see | Viremail can't see |
|---|---|
| The group's name, description and photo, and who is in it | What your encrypted messages say |
| Who sent each message and when, and roughly how big it is | Photos, videos, voice messages and files sent encrypted |
| Who you mention (so they're notified), and reactions | Quotes, stickers and GIFs you choose |
| Polls, Drive cards, invite cards and calls (these aren't end-to-end encrypted) | The secret part of an invite link |
| Who added, invited or removed whom | Your keys and your recovery key |
Scheduled messages aren't offered in encrypted groups, and Drive cards can't have captions there, because Viremail would have to read them. Notifications say there's a new message in the group, or that someone mentioned you, never what it says.
Honest limits
- When a group becomes encrypted, its member list at that moment is taken as Viremail shows it. The line where encryption starts says how many people it was for: open the group details to check them.
- Viremail could split a group in two, showing each half only its own messages and changes. It can't hide that from anyone who then sees a message from the other half.
- Groups of more than 256 people aren't end-to-end encrypted.
- Everything in Encrypted chats in Vire applies here too: your keys, recovery key and safety numbers work the same way.