Trusted-circle group messaging
Unlike public groups or channels that allow discovery, EmberChamber groups are strictly invite-only and designed for small, trusted circles. Group membership is managed on a closed basis: only existing group administrators or members can invite new participants, and there are no public links or access points that bypass this approval step.
New groups and device-encrypted history
In the latest active beta runtime, new groups are initialized with device-encrypted group history. When a message is sent to a group, it is encrypted for the active membership set using epoch keys managed on the devices in the circle. The relay routes the encrypted envelopes to the group members' mailboxes but has no access to the keys necessary to read the historical record.
Membership coordination
When a member is added to or removed from a group, a new epoch is established. The client devices coordinate key rotation to ensure that:
- Forward secrecy: Newly added members cannot decrypt messages sent before they joined the group.
- Post-compromise security: Removed members cannot read new messages sent after their departure.
Relay role and limitations in groups
While the relay coordinates the membership roster (i.e. who is currently in the group) and hosts the public key lists for members, it cannot decrypt the message contents or attachments. However, the relay operator does see which accounts are in the group, when membership changes occur, and the volume and frequency of group message envelopes.
Legacy compatibility caveat
EmberChamber is transitioning its systems. Older groups or rooms created during early testing phases may still rely on legacy compatibility paths. In these legacy flows, group history is hosted in a centralized database on the relay to simplify message retrieval. We strongly recommend creating new groups to ensure your conversations use the device-encrypted history protocol.
To get started, follow our Start Guide or Download the Client.