The revocation window

You take back access to something, and the interface says it is done. What the interface means is that a row changed on a server. What you heard is that the material is gone from wherever it went, which is a different sentence entirely, and the distance between the two is where most of the discomfort in modern privacy lives.

WhatsApp documents its own version of that distance more plainly than most, which is worth knowing because it removes the excuse that ordinary people cannot hold the idea. A sender has about an hour to request that a message be deleted for everyone. Recipients might see the message before it is deleted, or if the deletion was not successful. The sender is not told when it fails. Both parties need current versions of the app for the request to be honored at all, and on the iOS app a recipient may still hold media in their Photos library after the message itself has left the chat. Every one of those sentences is on the company’s own help pages rather than in a researcher’s write-up, and together they describe a revocation that is a best effort rather than an event.

The reason is structural and it survives every implementation. A copy already resting on a device that is not connected cannot be removed by any server action, so the mechanism is simply that revocation is an instruction which has to travel to each holder of a copy, and the material stays readable for as long as the instruction takes to arrive, which is nothing at all when the device is awake and unbounded when the device is a phone in a drawer. Cached email behaves this way. So does a file-sync folder, an offline document cache, and every messaging product that has ever offered to unsend. Naming this is not a confession about a particular product. It is a description of what synchronizing means.

What varies between products is not whether they carry the window, since they all do, but whether the person on the wrong side of it is told. Our own sync design notes hold the line we would want held against us, that we do not claim to eliminate the window, and they name the one setting that actually closes it, which is refusing to let the material reach devices in the first place and paying for that in offline access. Those notes describe a dormant capability rather than a shipping one, and the argument is what we are standing behind here, not an implementation anybody can go and use. The engineering may or may not return. The sentence holds regardless, because the honesty in it costs a paragraph and is available to any team today.

What that paragraph buys is a person who can act. Told that revocation is instant, someone who has just cut off access to something sensitive believes the matter is closed and stops thinking about it. Told the truth, which is that it usually resolves in seconds, that it can last as long as a device stays dark, and that they will not be notified either way, that same person makes different and better choices about what to send, to whom, and under what setting. The window has never been the failure. Every system that lets people work on a train has one, and the ones worth trusting are the ones that hand you its shape before you need it rather than after you have found it out for yourself.