Slashdot Mirror
Battle of the Secure Messaging Apps: Signal Triumphs Over WhatsApp, Allo (theintercept.com)
There is no shortage of messaging apps out there, so which one should you be using? If you care about your privacy, you would want your messaging client to be end-to-end encrypted. This narrows down the list to WhatsApp, Signal, and Allo. The Intercept has evaluated the apps to find which among the three is the best from the privacy standpoint. The publication says that while all the three aforementioned apps use the same secure messaging protocol (Open Whisper System's), they differ on exactly what information is encrypted, what metadata is collected, and what, precisely, is stored in the cloud.
WhatsApp:It's important to keep in mind that, even with the Signal protocol in place, WhatsApp's servers can still see messages that users send through the service. They can't see what's inside the messages, but they can see who is sending a message to whom and when.In addition, WhatsApp also retains your contact list -- provided you have shared it with the service. If government requests access to this data, WhatsApp could hand it over.
Allo:The first thing to understand about Google's forthcoming Allo app is that, by default, Google will be able to read all of your Allo messages. If you want end-to-end encryption via the Signal protocol, you need to switch to an "incognito mode" within the app, which will be secure but include fewer features. [...] Allo's machine learning features prevent Google from turning on end-to-end encryption for all messages, since Google needs to be able to ingest the content of messages for the machine learning to work, a Google spokesperson confirmed. Signal:The first thing that sets Signal apart from WhatsApp and Allo is that it is open source. The app's code is freely available for experts to inspect for flaws or back doors in its security. Another thing that makes Signal unique is its business model: There is none. In stark contrast to Facebook and Google, which make their money selling ads, Open Whisper Systems is entirely supported by grants and donations. With no advertising to target, the company intentionally stores as little user data as possible. Signal's privacy policy is short and concise. Unlike WhatsApp, Signal doesn't store any message metadata. [...] If you back up your phone to your Google or iCloud account, Signal doesn't include any of your messages in this backup.But what about Telegram, you ask? A Gizmodo report, also published on Wednesday, says that Telegram's default settings store your message on its unencrypted servers. "This is pretty much one of the worst things you could imagine when trying to send secure messages."
WhatsApp:It's important to keep in mind that, even with the Signal protocol in place, WhatsApp's servers can still see messages that users send through the service. They can't see what's inside the messages, but they can see who is sending a message to whom and when.In addition, WhatsApp also retains your contact list -- provided you have shared it with the service. If government requests access to this data, WhatsApp could hand it over.
Allo:The first thing to understand about Google's forthcoming Allo app is that, by default, Google will be able to read all of your Allo messages. If you want end-to-end encryption via the Signal protocol, you need to switch to an "incognito mode" within the app, which will be secure but include fewer features. [...] Allo's machine learning features prevent Google from turning on end-to-end encryption for all messages, since Google needs to be able to ingest the content of messages for the machine learning to work, a Google spokesperson confirmed. Signal:The first thing that sets Signal apart from WhatsApp and Allo is that it is open source. The app's code is freely available for experts to inspect for flaws or back doors in its security. Another thing that makes Signal unique is its business model: There is none. In stark contrast to Facebook and Google, which make their money selling ads, Open Whisper Systems is entirely supported by grants and donations. With no advertising to target, the company intentionally stores as little user data as possible. Signal's privacy policy is short and concise. Unlike WhatsApp, Signal doesn't store any message metadata. [...] If you back up your phone to your Google or iCloud account, Signal doesn't include any of your messages in this backup.But what about Telegram, you ask? A Gizmodo report, also published on Wednesday, says that Telegram's default settings store your message on its unencrypted servers. "This is pretty much one of the worst things you could imagine when trying to send secure messages."
But what about Telegram, you ask? A Gizmodo report, also published on Wednesday, says that Telegram's default settings store your message on its unencrypted servers. "This is pretty much one of the worst things you could imagine when trying to send secure messages."
Encrypted end-to-end by default.
Seeing their source does not assure you of anything. You'd have to decompile the app you download from the store to know if it was bugged.
It's Google. Google doesn't care about your privacy. In fact, Google hates your privacy. Don't touch anything from Google. It's an evil company.
"We commend Wickr for its strong stance regarding user rights, transparency, and privacy"
Wickr
I am not interested in articles about life extension advancements.
iMessage has a few issues:
-Can't verify keys
-By default, will send as SMS if you have data connection issues
-Will send as SMS regardless of settings if the other person's iPhone is signed out from iMessage
-Only works on iOS devices
Grammer Nazis - I mod you "troll" unless you actually add something on-topic. Yes, I know I have mispellings in my sig.
Wire has complete e2e--encryption and a full set of features missing in the other apps. (As well as all encryption bits being open source).
Simple comparison chart is here: https://wire.com/privacy/
..then you have already stopped obsessing with "apps" and are primarily concerned with protocols. Once you have decided on, say, XMPP plus OpenPGP extensions, then you have plenty of competing apps to chose from.
And of course, it follows that whatever protocol you use, will be "service-agnostic." Since you're going to pick something which uses a secure protocol, you basically don't care about servers; they're all commodities. Install jabberd or whatever at your Linode. Seriously: whatever.
I don't know how WhatsApp or Allo are even seriously considered. What do they speak? When people talk about the app more than the protocol, that's a bad sign. (e.g. I use the web and it's irrelevant whether I use it with Chromium or Firefox. The more you care about my specific browser, the more I think you're trying to talk me into not-using-the-web.)
This gets modded as Insightful? Really?
You don't have to have read TFA, read TFS ffs. They all use the Signal protocol, what is relevant is precisely the servers and what meta data they store and what their privacy policy says they will disclose to 3rd parties.
Hence the fricking article.