Session - Private Messenger

Session represents a significant shift in secure messaging design. Originally launched in 2018 as Loki Messenger under the cryptocurrency-focused Loki network, the platform was rebranded in 2019. It is now managed by the Swiss-based Session Foundation, a non-profit dedicated to digital rights and communication privacy.

When a user creates an account, Session does not request any personal identifiers. Instead, the client generates an asymmetric cryptographic key pair locally on the device. The public key is expressed as a 66-character alphanumeric string known as the Session ID. This ID serves as the user's secure contact address. This design eliminates the risk of SIM-swap attacks, registration censorship, and identity mapping through centralized directories.

Session routes all traffic through a decentralized network called the Oxen Service Node Network. Instead of relying on central corporate servers, the network uses a multi-hop onion routing protocol. When a message is sent, the client encrypts it in layers and routes it through three volunteer-operated nodes. Each node decrypts only the layer necessary to identify the next hop. As a result, no single node in the transit path knows both the sender's IP address and the recipient's identity, preventing the collection of messaging metadata or communication patterns.

Message payloads are secured using an adapted version of the Signal protocol, optimized for decentralized systems. Messages are not stored on a central server; instead, they are held in temporary, encrypted database storage swarms managed by the Oxen service nodes.

The recipient's client polls these swarms directly to retrieve pending messages. This design is supported by device-to-device syncing, which updates read states across multiple devices without exposing private keys.