1·8 hours ago- Wire API calls use WebRTC, DTLS, SRTP, and TURN relays, which all encrypt data but leak metadata
- Creator, timestamp, participants, devices, and group name are stored server-side https://github.com/wireapp/wire/issues/103
- Server therefore can infer who is connected to whom and which devices belong to each account https://github.com/wireapp/wire/issues/214
- No mitigation from timing attacks https://www.research-collection.ethz.ch/bitstreams/669f99ed-bbdc-4818-b0b9-0519e0427d42/download