What You Leak Without Saying Anything
You can encrypt every word and still give yourself away. Metadata is the data about your data — and it is usually louder than the message.
Okay, I encrypt my messages now. The contents are safe. So the metadata thing does not apply to me, right?
I love it when people say that. I almost never need to read your messages. I need to know who you talked to, when, and from where. You hand me that for free.
This is the lesson people resist most, because it is the one that says the careful thing you did was not the thing that mattered.
Content versus metadata
MetadataMetadataData about your data — not what you said, but who you said it to, when, from where, and how often. is everything about a message except the message. Not what you said — that you said it, to whom, when, how often, from where, and for how long. Encryption protects content. It does almost nothing for metadata, and metadata is usually the more revealing of the two.
Content: "Meet me at the usual place at eight." <- encrypted, unreadable
Metadata: you -> a divorce lawyer, Tuesday 09:14, then
you -> a locksmith, 09:31, then
you -> your bank, 09:40, all from downtown
- Line 1Perfectly protected. Nobody can read it. It is also the part nobody needed to read.
- Line 2No words required. The pattern of who and when tells a story the encrypted sentence never could. This is why metadata matters more.
A phone company has none of your message contents — everything you send is end-to-end encrypted. How much of your life can it still describe?
The photo problem, concretely
The most common metadata leak in ordinary life is a photo. A camera writes EXIFEXIFHidden data a camera writes inside a photo file — often including the exact time and GPS coordinates the picture was taken. data inside the file: the time, the device, and — if location is on — the exact spot. Share the raw file and you share all of it.
$ exiftool selfie.jpg
Create Date : 2026:08:14 19:42:03
Camera Model Name : iPhone 15
GPS Position : 51.507351, -0.127758
Serial Number : F2L...redacted
# time, device, a serial that links your other photos, and a doorstep
You post a photo to a big social network and also send the original to a friend on a messaging app. Which one is more likely to leak the GPS location?
Why it is hard, and what actually helps
Fighting the wrong half
- Encrypt everything and stop thinking
- Trust that "private" apps are private in every sense
- Send original files because they are "better quality"Reducing what you emit
- Turn off camera location, or strip EXIF before sending
- Assume who-and-when is visible even when what is not
- Separate identities so patterns cannot be linked across them
- For a serious adversary, use tools built to hide metadata: [[tor|Tor]]You cannot encrypt metadata away the way you encrypt content. You reduce it: emit less, link less, and where it truly matters, use a network designed to break the link between you and your destination.
So the careful encryption was not wasted — it was just not enough.
Exactly right. Content protection is necessary and easy. Metadata protection is harder, usually more important, and the reason the next course spends real time on it.
And it is why I will always prefer the timeline of your life over the text of one message. Give me the pattern and I do not need the words.
Legal
This is about understanding and reducing your own exposure. Reconstructing someone else's movements or relationships from their metadata without authorisation is surveillance, and it is exactly the harm this teaches you to defend against.
So the discipline is not "encrypt harder" — it is "emit less, and know what you are emitting." Match it to your threat modelThreat modelFour honest answers: what you are protecting, from whom, what happens if it fails, and how much trouble you will go to.: an advertiser buys your patterns, a stalker reads a single photo's EXIFEXIFHidden data a camera writes inside a photo file — often including the exact time and GPS coordinates the picture was taken., a government reads the whole timeline. That is the end of Foundations. From here, each course picks the concrete tools — starting with the browser, where most of this leaks first.