Slashdot Mirror
Battle of the Secure Messaging Apps: Signal Triumphs Over WhatsApp, Allo (theintercept.com)
There is no shortage of messaging apps out there, so which one should you be using? If you care about your privacy, you would want your messaging client to be end-to-end encrypted. This narrows down the list to WhatsApp, Signal, and Allo. The Intercept has evaluated the apps to find which among the three is the best from the privacy standpoint. The publication says that while all the three aforementioned apps use the same secure messaging protocol (Open Whisper System's), they differ on exactly what information is encrypted, what metadata is collected, and what, precisely, is stored in the cloud.
WhatsApp:It's important to keep in mind that, even with the Signal protocol in place, WhatsApp's servers can still see messages that users send through the service. They can't see what's inside the messages, but they can see who is sending a message to whom and when.In addition, WhatsApp also retains your contact list -- provided you have shared it with the service. If government requests access to this data, WhatsApp could hand it over.
Allo:The first thing to understand about Google's forthcoming Allo app is that, by default, Google will be able to read all of your Allo messages. If you want end-to-end encryption via the Signal protocol, you need to switch to an "incognito mode" within the app, which will be secure but include fewer features. [...] Allo's machine learning features prevent Google from turning on end-to-end encryption for all messages, since Google needs to be able to ingest the content of messages for the machine learning to work, a Google spokesperson confirmed. Signal:The first thing that sets Signal apart from WhatsApp and Allo is that it is open source. The app's code is freely available for experts to inspect for flaws or back doors in its security. Another thing that makes Signal unique is its business model: There is none. In stark contrast to Facebook and Google, which make their money selling ads, Open Whisper Systems is entirely supported by grants and donations. With no advertising to target, the company intentionally stores as little user data as possible. Signal's privacy policy is short and concise. Unlike WhatsApp, Signal doesn't store any message metadata. [...] If you back up your phone to your Google or iCloud account, Signal doesn't include any of your messages in this backup.But what about Telegram, you ask? A Gizmodo report, also published on Wednesday, says that Telegram's default settings store your message on its unencrypted servers. "This is pretty much one of the worst things you could imagine when trying to send secure messages."
WhatsApp:It's important to keep in mind that, even with the Signal protocol in place, WhatsApp's servers can still see messages that users send through the service. They can't see what's inside the messages, but they can see who is sending a message to whom and when.In addition, WhatsApp also retains your contact list -- provided you have shared it with the service. If government requests access to this data, WhatsApp could hand it over.
Allo:The first thing to understand about Google's forthcoming Allo app is that, by default, Google will be able to read all of your Allo messages. If you want end-to-end encryption via the Signal protocol, you need to switch to an "incognito mode" within the app, which will be secure but include fewer features. [...] Allo's machine learning features prevent Google from turning on end-to-end encryption for all messages, since Google needs to be able to ingest the content of messages for the machine learning to work, a Google spokesperson confirmed. Signal:The first thing that sets Signal apart from WhatsApp and Allo is that it is open source. The app's code is freely available for experts to inspect for flaws or back doors in its security. Another thing that makes Signal unique is its business model: There is none. In stark contrast to Facebook and Google, which make their money selling ads, Open Whisper Systems is entirely supported by grants and donations. With no advertising to target, the company intentionally stores as little user data as possible. Signal's privacy policy is short and concise. Unlike WhatsApp, Signal doesn't store any message metadata. [...] If you back up your phone to your Google or iCloud account, Signal doesn't include any of your messages in this backup.But what about Telegram, you ask? A Gizmodo report, also published on Wednesday, says that Telegram's default settings store your message on its unencrypted servers. "This is pretty much one of the worst things you could imagine when trying to send secure messages."
Want a messaging app that is secure, get a peer-to-peer messaging app that does not depend on servers.
SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
The one your friends and family use. What's the point of a secure messaging network if nobody you know uses it?
..then you have already stopped obsessing with "apps" and are primarily concerned with protocols. Once you have decided on, say, XMPP plus OpenPGP extensions, then you have plenty of competing apps to chose from.
And of course, it follows that whatever protocol you use, will be "service-agnostic." Since you're going to pick something which uses a secure protocol, you basically don't care about servers; they're all commodities. Install jabberd or whatever at your Linode. Seriously: whatever.
I don't know how WhatsApp or Allo are even seriously considered. What do they speak? When people talk about the app more than the protocol, that's a bad sign. (e.g. I use the web and it's irrelevant whether I use it with Chromium or Firefox. The more you care about my specific browser, the more I think you're trying to talk me into not-using-the-web.)
n/t
"When I first heard Daydream Nation it quite frankly scared the living shit out of me." -- Matthew Stearns
> Want a messaging app that is secure, get a peer-to-peer messaging app that does not depend on servers.
And:
(1) Was not compiled by anyone else
(2) Does not depend on libraries compiled by anyone else
(3) Does not run on an operating system compiled by anyone else
(4) Does not run on hardware built by anyone else
(5) Is completely bug-free all the way down to the hardware
(6) Does not depend on unique identifiers like telephone number
(7) Only uses onion routing to prevent 3rd parties from building a social-graph of your contacts
(8) Does not draw attention to itself by using onion routing
(9) Does not require so much network activity that it drains your battery prevents you from communicating
(A) Is easy enough to use that your non-technical contacts can actually use it
(B) etc
Every choice in life is a trade-off. There is no such thing as perfect. You must prioritize what matters most to you.
But more broadly, anything the increases the cost of non-targeted "drag-net" style surveillance benefits all of us, even those of us who don't actually use the app.
WhatsApp: You might have a chance of actually being able to communicate with someone you know - especially if you live in Brazil.
Allo: "The first thing to understand about Google's forthcoming Allo app..." - yeah, because Google Plus was such a hit.
Signal: The good news is, you can probably find all your Diaspora friends on this one.
Seriously... let's ignore all the ones that most people actually use, shall we?
#DeleteChrome
I think it's stupid to talk about privacy and centralized services. Only federation can give use decent privacy level. Like XMPP. XMPP has e2e encryption (OMEMO, PGP, OTR). And serverless solutions like Tox. Although, it's still missing some important functionality. If you have a choice use decentralized services.