Chat Control + Obscura — The paradox of the one who protects themselves in encrypted messagingChat Control + Obscura — The paradox of the one who protects themselves in encrypted messaging

What Obscura discovered about browser fingerprinting is replicated point by point in communications encryption. The structure is the same. Only the layer changes.

---

Obscura's research on browser fingerprinting revealed a fundamental asymmetry that structures the entire field of digital privacy:

The defender must win every time. The attacker only needs to win once.

In Obscura, this materialized in the fingerprinting surface: ~55% of vectors are controllable through a proxy, but the remaining ~45% —GPU, audio, CPU, behavior— escapes any protection layer. The defender needs to block all vectors; the attacker only needs one successful one.

In Chat Control, the same asymmetry is replicated with an almost identical structure.

The same asymmetry, different layer

The consistency paradox

Obscura demonstrated that the most powerful way to detect a protected user is not through a single vector, but through cross-layer comparison. The inconsistency between what one layer says and what another shows betrays the proxy.

User-Agent: Chrome 120 / Windows 11
JA3 fingerprint: TLS 1.3 Chrome 120 (Win11)  ✓ Consistent
                              ↓
User-Agent: Chrome 120 / Windows 11
TTL: 64 (Linux default)                    ✗ INCONSISTENT → Proxy detected

In Chat Control, the same pattern applies:

Payload: [externally encrypted bytes, high entropy]
Metadata: User A → User B, same device, same app

If 99% of messages on the platform have structured format
and low entropy, and A's have high entropy:
    → A is "inconsistent" with the expected profile
    → A is detectable as "user who encrypts externally"
    → If the law requires blocking, A is blocked

The detectable minority problem

One of the most unsettling conclusions from Obscura is that protection creates its own detectable cluster. Tor Browser makes all its users indistinguishable from each other, but perfectly distinguishable from an unprotected Chrome user.

In Chat Control, the same occurs:

WhatsApp users without external encryption:
    → All follow the same expected profile
    → Indistinguishable from each other

Users with external encryption:
    → All have high entropy in their messages
    → Indistinguishable from each other... but DISTINGUISHABLE from the normal profile
    → They form a cluster → "users who protect themselves"

The analogy is exact. The Tor user cluster is detectable as a cluster; the external encryption user cluster is detectable as a cluster. In both cases, the act of protecting oneself creates the signal that betrays the one who protects themselves.

The geometry of protection

We can formalize this analogy with the same structure Obscura uses for fingerprinting vectors:

$$H_{chat} = \sum_{i \in \mathcal{V}} H_i^{(\text{normal})} - H_i^{(\text{protected})}$$

Where:

• $\mathcal{V}$ are the detection vectors in messaging (payload entropy, format, size, frequency, metadata)
• $H_i^{(\text{normal})}$ is the expected distribution of vector $i$ for a normal user
• $H_i^{(\text{protected})}$ is the distribution of the same vector for a user who encrypts externally

The divergence between both distributions is the protection signal. The greater the divergence, the more detectable the user is.

Implications

The connection between Obscura and Chat Control reveals something that transcends both particular cases:

Digital privacy is not a problem of tools but of structures. The defender-attacker asymmetry is not a bug of a specific design; it is an emergent property of systems where surveillance is mass and protection is individual.

Obscura documented this asymmetry for fingerprinting. Chat Control replicates it for messaging. The same structure will appear in any other domain where a centralized system attempts to identify protected behaviors. The question is not "which tool protects better?" but "how is the structural asymmetry broken?"

And the provisional answer, in both Obscura and Chat Control, is the same: protection is only effective when it is indistinguishable from non-protection. Any deviation from the expected profile —no matter how small— is a signal that the system can exploit.

---

Related documents:

• Obscura — Conclusions
• Chat Control — External encryption and shared keys
• Chat Control — Encryption and surveillance
• Chat Control — Alternatives to mass scanning