The adversary’s manual

Breaking Cutout.

No system is unbreakable — the honest ones tell you how theirs breaks. Below is the complete list of every attack we know of against Cutout: how it works, what it exposes, who could mount it, and what you can do about it. Read it, then judge your own risk against your own adversary — not ours.

One honest rule frames all of it: Cutout moves the hard problems to places you can see and control — your device, your face-to-face meetings, the server you deploy. It does not make those problems disappear.

How to read this

Every threat, on the same three axes.

Skim the tags to find the attacks that fit your situation. A journalist under a state adversary and a friend group dodging ad-tech weigh these very differently.

Surface

Where the attack lands — your device, a QR meeting, the network, the server, or another person’s client.

Who

Who can realistically do it — a thief, a contact, the server operator, a network observer, a state.

Residual

What’s left after Cutout’s defenses — and the concrete thing you can do to shrink it.

1 · Your device

The endpoint is the prize. It always is.

Cutout keeps everything local and nothing on the server — which means your device holds all of it. End-to-end encryption protects data in transit and at the server; it can do nothing about an adversary who holds the unlocked end.

Seized or stolen device

High impact

How it works. Physical possession of your phone. If it is unlocked — or the attacker can unlock it — the Cutout store is right there: your identity key, every contact and their pair secrets, group keys, full message history, and the audit log. There is no server copy to withhold and no remote wipe.

Surface: device at rest Who: thief · border agent · police · coercion

Residual & what you do. Turn on the app lock: a PIN or passphrase wraps the data-encryption key with scrypt, so the store is unreadable without it even on an unlocked phone. Use a strong device passcode and encryption. Understand the limit: an attacker who seizes the device while Cutout is open, or extracts the key from memory, still wins — no software fixes a compromised endpoint. For the highest-risk trips, carry a device that holds nothing.

Coercion — the rubber-hose unlock

High impact

How it works. Nobody breaks the crypto; they compel you to open the app — at a border, in custody, under threat. Cutout has no duress code and no hidden-vault deniability today, so an unlock reveals what the unlocked app can see.

Surface: you Who: state · border · anyone with leverage

Residual & what you do. Carry less: delete sensitive conversations before crossing a hostile boundary (history is local, so deletion is real and complete). Consider a separate low-content identity for travel. Deniable-vault and duress-unlock features are on the honest to-do list, not shipped — do not rely on what isn’t there.

Malware & spyware on your own phone

Endpoint compromise

How it works. Commercial spyware or a malicious app with enough privilege reads your screen, keystrokes, or storage. Once the endpoint is owned, it sees plaintext as you do — every messenger on earth is equal here.

Surface: device at runtime Who: state-grade spyware · a device you don’t control

Residual & what you do. Keep the OS patched, install little, and prefer the native app on a device you trust. Cutout cannot defend a platform that is already against you; no end-to-end system can.

2 · The people you talk to

Encryption protects the channel, not the other end of it.

Every conversation has a second endpoint you don’t control. The protocol can prove who sent something and constrain what they can claim — it cannot make them trustworthy.

A malicious or modified client

By design, unpreventable

How it works. The person you message runs a tampered app that logs, screenshots, or forwards everything you send them. This is inherent to messaging: anyone you talk to can keep a copy. What a bad client cannot do is forge cryptography — it can’t sign a vouch with a key it doesn’t hold, can’t impersonate a member id it can’t produce a key for, and can’t read conversations it isn’t part of.

Surface: the far endpoint Who: a contact · someone who compromised their device

Residual & what you do. Choose who you talk to; green (in-person verified) contacts are the people you have the most reason to trust. Nothing you send anyone can be un-sent. Prefer reproducible, signed builds so your client is the honest one.

The malicious introducer (a targeted MITM)

Trust displacement

How it works. Introductions let a contact connect you to someone you’ve never met. A dishonest introducer could fabricate the “someone” — presenting a key they control and sitting in the middle. The crypto can’t stop this, because everything you know about the new person arrives through the introducer.

Surface: introduction Who: a contact who relays introductions

Residual & what you do. This is exactly what the colours mean: an introduced contact is never green — the app tells you the channel is only worth your trust in the introducer. When you meet in person, use Verify by QR: because a member id is bound to its key, a mismatch means the person in front of you is not who you were introduced to, and the app warns you loudly. The audit log records the whole provenance chain.

A contact who renames or misrepresents themselves

Social engineering

How it works. Someone you know changes their display name to impersonate a third party, or leans on a familiar name to gain trust. Names are cheap.

Surface: identity presentation Who: any contact

Residual & what you do. Your local label always wins over a name someone announces, and every self-rename is post-quantum-signed and recorded in the tamper-evident identity history — so “Bob now calls himself Alice” shows up as a flag, not a silent swap. Trust the colour and the key, never the name.

Group members are a metadata surface

Inherent to groups

How it works. Everyone in a group necessarily learns the group’s membership and sees its messages. Any one member can leak that roster or the contents. The server still learns none of it — but your fellow members are, by definition, insiders.

Surface: group roster Who: any group member

Residual & what you do. Treat group membership as known to the group. Keep sensitive groups small and composed of people you’ve verified; remove members you no longer trust (removal rekeys the group so they lose future messages).

3 · The in-person exchange

The QR is the root of trust — and a live secret.

Moving key exchange into the physical world removes the network attacker. It puts a small, sharp responsibility on the moment of the scan.

Shoulder-surf or photograph of a displayed QR

Live secret exposure

How it works. A p2p QR carries live pair secrets. A camera across the room, a reflection, or a shoulder-surfer who captures it can derive the same channel — until those secrets rotate.

Surface: the scan moment Who: anyone with line of sight

Residual & what you do. The exchange is physical precisely so you control the room. Show your QR only to the person scanning it, mind reflections and cameras, and don’t photograph or screenshot QR codes. The app warns you at every display.

A relayed QR (scanning a screen, not a person)

Presence spoofing

How it works. If you scan a QR shown to you over a video call or on a forwarded photo rather than off a physical device in front of you, you lose the one guarantee the in-person scan gives: that the key belongs to the body in the room.

Surface: the scan moment Who: a remote impersonator

Residual & what you do. Only green-verify by scanning a QR off a real device held by the real person. If you scanned remotely, treat the contact as unverified until you meet.

4 · The server

It can’t read you. It can still refuse to carry you.

The whole design assumes the server is hostile — so a compromised or malicious operator learns almost nothing (see the boundary). What a server controls is availability, not confidentiality.

Censorship, dropping, and denial of service

Availability

How it works. The operator can slow, drop, or refuse traffic, or take the server down. It cannot tell which blobs are real, so it can’t censor selectively by content or recipient — but it can degrade everyone, or block your IP.

Surface: the server Who: the operator · anyone who seizes it

Residual & what you do. Run your own server, or use one run by people you trust — that is the point of self-hosting. Clients switch servers with a QR scan, so a dead or hostile server is a migration, not a lock-in.

Injection and replay

Well-contained

How it works. A malicious server tries to forge messages or replay old ones. Forgery fails — it can’t compute the routing tags or AEAD without the shared secret it never holds. Replay is bounded by per-stream sequence numbers and a replay window on the client.

Surface: the server Who: the operator

Residual & what you do. Nothing to do — this one is handled in the protocol. Listed for completeness, and because “handled” should be checkable: the source is public.

A backdoored server binary

The chat-control case

How it works. An operator is compelled — or chooses — to run a modified server. Because the server holds only opaque, expiring blobs, even a fully backdoored one has nothing to read or hand over. It could still log IPs and timing, or degrade availability.

Surface: the server Who: a compelled or malicious operator

Residual & what you do. This is the reason to self-host: when you deploy the published source, you know nobody added a backdoor, because the operator is you. Pair it with a tunnel to remove the IP the server does see.

5 · The network

What a global observer can still measure.

Constant-rate cover traffic hides the content and shape of your activity. It cannot make the fact of a connection vanish.

Your IP address reaches the server

Metadata residue

How it works. A direct connection tells the server (and your ISP) that your IP talks to a Cutout server, and when. It reveals nothing about content, contacts, or which blobs matter — but “this person uses this server” can itself be sensitive.

Surface: the wire Who: ISP · server operator · network observer

Residual & what you do. Use the outbound tunnel — Tor for no-trust routing, or WireGuard to displace the IP to a provider you trust more than the server’s network. If the tunnel drops, the app fails closed and sends nothing. (Tunnel modes are in development; until then, front the connection with Tor Browser or a VPN you trust.)

Traffic-analysis at the sleeping edge

Timing correlation

How it works. Cover traffic depends on emitting a steady rate. Phones suspend background apps, so the stream has gaps when your device sleeps. An adversary watching both your link and the server could correlate those gaps with activity. Bursty control flows — a batch of introduction packets, say — are a mild extra signal.

Surface: the wire, over time Who: a global passive observer

Residual & what you do. The native app maximizes the constant rate within OS limits; the browser client is weaker still and says so with a permanent notice. Route through Tor to break the both-ends correlation, and know that aggregate volume at 30-second tick granularity is visible by design — cover traffic flattens what it reveals, it cannot erase that traffic exists.

6 · The cryptography & the code

The long-horizon and the supply-chain risks.

The math is chosen to survive quantum computers. Two honest caveats remain: one place secrets touch the wire, and the question of whether the client you run is the client we wrote.

An introduced channel, recorded, versus a future ML-KEM break

Harvest-now, decrypt-later

How it works. A channel you got by introduction had its secrets cross the wire once, sealed with post-quantum ML-KEM-768. A QR-scanned channel never did. If ML-KEM-768 were broken decades from now, a recording of that one introduction packet could expose that channel’s history (1-to-1 has no ratchet, so it’s the whole channel).

Surface: recorded E2E payload Who: an adversary who records now and breaks PQ crypto later

Residual & what you do. The trust colours are this hierarchy: green = never on the wire, blue/red = on the wire once. Verify introduced contacts in person; it rotates their secrets into the QR class and closes the window. For the most sensitive relationships, meet and green-verify from the start.

A backdoored client — including a hostile PWA host

Supply chain

How it works. The strongest crypto is void if the app running it is malicious. The web client is served as static files by some host — if you load a PWA from a server you don’t control, that host could ship a backdoored client that leaks your keys, and you’d never see it. The same logic that makes self-hosting the server matter applies to the client.

Surface: the client build Who: whoever ships you the app

Residual & what you do. Prefer the native app’s reproducible, signed builds from a pinned toolchain. If you use the PWA, host it yourself from the published source — the same static files you can read. Don’t run a security client from a party you wouldn’t trust with your keys, because that’s what running it is.

A broken platform RNG

Foundational

How it works. Keys, nonces, and secrets all come from the operating system’s cryptographic random generator. If that RNG is backdoored or badly broken, generated secrets could be predictable — a failure beneath every cipher choice.

Surface: the OS CSPRNG Who: a platform-level adversary

Residual & what you do. Cutout uses only the platform CSPRNG (no home-grown randomness) and 192-bit nonces so no counter state can be corrupted. Beyond that, this is trust in your OS — run one you have reason to trust.

“Aliens” — a break of symmetric crypto itself

Out of model, stated anyway

How it works. If XChaCha20-Poly1305 or SHA-256 were fundamentally broken — not just weakened by quantum search — the confidentiality of everything falls. This is outside the threat model, which already assumes “aliens with infinite resources” only in the sense of quantum computers.

Surface: mathematics Who: nobody known to exist

Residual & what you do. Symmetric crypto faces only Grover, not Shor — 256-bit keys keep ~128-bit effective strength against quantum search. There is no action to take; it is here so the list is complete and honest.

A security tool that hides its limits is a trap. Cutout’s defenses are strong exactly where it claims — the server, the network, the metadata — and it names, out loud, the places it cannot help: your unlocked device, the people you choose, the code you choose to run. Now you can weigh your own risk with open eyes.