Start with the threat these defenses answer. An adversary watching your encrypted connection cannot read the contents, but can measure the metadata: the timing of packets, their sizes, the direction of flow, and the rhythm of a conversation. From those measurements alone, a great deal can be inferred. This is the field of traffic analysis, and it is powerful. Researchers have used it to fingerprint which web page a user loaded over an encrypted tunnel, to detect voice activity inside encrypted calls, and to tell when two parties are talking even when the content is fully protected.
Encryption was never designed to hide these things. It protects the message, not the envelope, and not the timing of when envelopes move. Defeating traffic analysis needs a different tool, one that manipulates the pattern itself.
Padding: hiding size
The simplest of the two ideas is padding. If messages of different lengths produce packets of different sizes, then size leaks information. A short reply and a long document look different on the wire even when both are encrypted. Padding adds filler bytes to bring messages up to a fixed size, or to one of a small set of standard sizes (sometimes called size buckets), so that many different real messages all look identical from outside.
Padding to a fixed size is cheap and common at the primitive level. Block ciphers pad plaintext to a block boundary. Some messaging protocols pad message contents to standard lengths so that a one-word reply and a longer sentence are indistinguishable. The cost is modest, a little wasted bandwidth, which is why padding shows up in more places than full cover traffic does.
Padding hides how big a message is. It does nothing about when it is sent. If you pad every message to the same size but still transmit only when you actually have something to say, an observer still sees exactly when you are active and can count your messages. Timing survives padding, and timing is often the more revealing channel.
Cover traffic: hiding timing and existence
Cover traffic (also called chaff or dummy traffic) attacks the harder problem. The idea is to send messages that carry no real content, mixed in with the real ones, so that an observer cannot tell which transmissions matter. Taken to its logical end, this becomes constant-rate traffic: your device sends a message at a fixed cadence no matter what, and whether any given one is real or filler is invisible from outside.
Done properly, constant-rate cover traffic is strong. If you always send one fixed-size packet per second, an observer sees an unbroken, featureless stream. They cannot tell when you sent a real message, how many you sent, or even whether you sent any at all during a given hour. The pattern that traffic analysis feeds on has been erased and replaced with noise.
That strength is why cover traffic appears in the most serious anonymity systems. Mix networks such as the Loopix design use cover traffic drawn from a random (Poisson) schedule, so that messages are hidden not just in content but in the steady hum of dummy traffic flowing between every participant and the network. The goal is protection even against a global passive adversary, someone who can watch every link at once.
The reason almost nothing uses it
Cover traffic is expensive in exactly the ways that matter for a consumer product. Constant-rate transmission means sending data when you have nothing to say, which burns bandwidth, battery, and mobile data continuously. The stronger the anonymity target, the higher the fixed rate has to be, and the more it costs every user all the time, even when idle.
There is also a coverage problem. Cover traffic only helps if enough participants generate it, and if the network relays it in a way that genuinely blends users together. A single user padding their own traffic in isolation gains far less than a whole network doing it in concert. That is a coordination cost on top of the bandwidth cost.
Even Tor, which is the most widely used anonymity network, applies only limited padding rather than full constant-rate cover traffic, precisely because the performance hit of the strong version would be intolerable for browsing. Tor uses targeted circuit and connection padding to frustrate specific attacks, a pragmatic middle ground rather than the theoretical maximum.
| Defense | Hides | Cost |
|---|---|---|
| Message padding | Size only | Low (a little bandwidth) |
| Targeted padding (Tor-style) | Some specific timing patterns | Moderate |
| Constant-rate cover traffic | Size, timing, and existence | High (continuous bandwidth and battery) |
When it is worth the cost
The honest framing is that these defenses are matched to a specific threat: a network-level observer who is trying to learn from your metadata. If your concern is that a service cannot read your messages, ordinary end-to-end encryption handles it and cover traffic buys you nothing. If your concern is that a powerful observer should not even be able to tell that you communicated, or with whom, or when, then metadata defenses become the point, and their cost becomes justified.
This is why cover traffic lives in high-assurance research systems and in tools built for sources and whistleblowers, and not in mainstream apps. It is the difference between hiding the letter and hiding the fact that any letter was sent at all. Related ideas appear in sealed sender, which hides who sent a message, and across the broader problem space of metadata surveillance.
The takeaway
Content encryption and metadata protection are two different jobs with two different price tags. Encrypting content is cheap and should be universal. Hiding the shape and timing of that content is costly and belongs where the threat model actually demands it. Padding is the affordable partial measure most systems can afford. Full cover traffic is the strong, expensive version reserved for the cases where an observer knowing that you spoke is itself the danger. Any service claiming to hide your metadata should be able to say which of these it does, and at what cost.
Where Haven fits
Haven's job is content: message and email bodies are encrypted end to end on the device, using PGP for email and the MLS protocol for group chat, so the contents are unreadable to any server or network in the path. We are direct about the boundary of that protection. End-to-end encryption does not, on its own, hide the timing or the fact of your communication from a network observer, and constant-rate cover traffic is not something a general-purpose email and chat app can impose on every user without making it unusable. For metadata resistance at that level, tools like Tor and mix networks exist and can be layered underneath. Knowing which tool covers which threat is how you build a real answer instead of a marketing one.