Right now, if there is a disappearing message timer, and it gets disabled, you can still see until forever that there were disappearing messages, even if the messages themselves have been deleted. This is suspicious to any police officer who seizes the device; they can now see that something sensitive was communicated, that there is something to hide.
Proposed changes:
- As soon as the timer is disabled, start a self-destructing timer on both the “timer was set” and “timer was disabled” system messages. The timeframe should be the same as the self-destructing timer had.
- As soon as the timer is changed, delete the system message which showed the previous timer.
Any opinions on this? In what sense could it be weird/unexpected to the user?
1 Like
One problem with the proposed flow is that there might be messages with an unclear timer then. For example in the following scenario:
- set the timer to 24 hours, this creates a system message “timer set to 24 hours”
- send “example message”
- set the timer to 5 minutes. This deletes the system message from 1
- now disable the timer completely, this lets the system message of 3 expire in 5 minutes, and creates a system message which expires itself after 5 minutes.
- now wait 5 minutes; the only message which is visible now is the example message from 2, all system messages have vanished. There is no indication this example message will vanish (or when).
- after 24 more hours, all messages and system messages are gone.
This bug is a bit weird; maybe it is better to do it like this instead:
- As soon as the timer is disabled, start a self-destructing timer on both the “timer was set” and “timer was disabled” system messages. The timeframe should be the same as the self-destructing timer had.
- As soon as the timer is changed, start a self-destructing timer on the old “timer was set” system message. The timeframe should be the same as the old self-destructing timer had.