I refer specifically to their "note on outgoing messages" in their validation document on their website:
It may seem strange that outgoing messages can be decrypted by entering the sender's private key and the recipient's public key, i.e. without knowing the recipient's private key. ...
Now, consider this scenario:
- Alice has received a message from Bob, while Eve records/intercepts traffic as person-in-the-middle on the way to Alice.
- Alice's public key of course is public, but Alice never disclosed the private key.
- Eve somehow gets the private key of Bob.
With Bob's key and the traffic, could Eve now decrypt all content Bob has ever sent to Alice?
In other words, with Threema, is the privacy of received content dependent on the safety of the private key of the SENDER?