NOTE: 2019-05-14: The introductory note is from March 2017. I haven't altered the text of this article since then, other than to insert this note at the top.
Introductory Note
I've had this post in draft form for a few months but, in light of the events of the past few days, I feel that now is the time to publish it.
Summary
These days a lot of people are worried that their private communications are no longer private and, in many cases, they're right.
A little while ago I was speaking to a friend of mine about a criminal case we'd heard about in which my friend said the conviction was secured partly due to the guilty party not having deleted some incriminating SMS messages from their mobile phone. When I pointed out that the messages could be retrieved from the mobile phone service provider, even if they had been deleted, my friend seemed surprised. This made me wonder how many other people didn't realise that most[1] of their online correspondence is kept for posterity.
I don't need to explain why some online communications need to be encrypted (e.g. anything containing sensitive information such as financial data, medical records, etc). And I don't want to get into a discussion about whether or not governments should be able to spy on their citizens. However, from a purely practical point of view, it's quite reasonable not to want people recording all of your communications in case the people storing them are idiots and mess up the storage. [This paragraph was written in January, but I didn't want to change it]
Building in a back door into an encryption mechanism is a terrible idea, unless you can guarantee that a criminal won't ever discover it. Which you can't.
It's also worth bearing in mind that, if you outlaw encryption, that's only going to stop law-abiding people from using it.
Why use Signal?
It's free and it's open source. Check out the code on GitHub. It's seamless (it can take over your SMS application on Android). They're a non-profit supported by donations. It's endorsed by people like Bruce Schneier and Edward Snowden. In fact Bruce Schneier said he preferred to use Signal to sending a PGP-encrypted email. Now, in some cases, I still think PGP encryption is worthwhile, but for general day-to-day use and specifically taking ease of use into account, I think he's right.
If you're sending SMS messages to people overseas, you are probably incurring some cost. If you can send those messages more securely and at no cost, why wouldn't you?
You can make encrypted voice and video calls.
Surely if it's free then I'm the product?! Not necessarily and, I believe, not in this case.
Why use WhatsApp?
Most of the same reasons apply. It's also free. It's very similar to Signal. It supports encrypted messaging, voice and video calls. In fact it uses a fork of the Signal code from Open Whisper Systems. However, it's not open source. It has a much larger user base (over a billion users).
What about logging?
This is interesting. Whilst the code for WhatsApp Messenger started off the same as for Signal, do you really think they aren't logging any information and won't hand over these logs if a government agency applies pressure on them to do so? If you do, or if you don't believe that such a concern applies to you (and let's be honest, for most people that probably isn't a concern), then that's your prerogative and you should go ahead and continue to use WhatsApp.
Incidentally, just in case that sounds like I'm saying it's not okay to use, I do think it's safe to use WhatsApp and I don't think they can retrieve your messages either. However, you might want to read this from Graham Cluley and then this from Bruce Scheneier in which he said, amongst other things,
Note that it's an attack against current and future messages, and not something that would allow the government to reach into the past. In that way, it is no more troubling than the government hacking your mobile phone and reading your WhatsApp conversations that way.
After The Guardian reported that there was a backdoor in WhatsApp, Zeynep Tufekci and a number of other security researchers wrote them an open letter in which they explained that there wasn't really. Finally, you might like to read this, from the person that discovered the vulnerability, Tobias Boelter.
Having read all of those articles, you should be suitably confused, but I'm afraid you're going to have to make up your own mind; I can't tell you what to do.
How do we know what they're logging?
You should know that Signal have already demonstrated that they really aren't logging information, so when they hand over everything they have, it's practically useless.
When the FBI made them hand over any information about a telephone number, the only information they had was the telephone number, the date the account was created and the date it was last accessed.
They really didn't have any useful information to hand over. There's quite a good write up here and you can even read the subpoena documents and see for yourself.
Stop sitting on the fence
My personal opinion is that it's not only the bad guys who don't want people eavesdropping on them and that providing back doors into all software that is hitherto believed to be secure is a terrible idea as there's no way to ensure that criminals can't access them and, in any case, sufficiently motivated people will simply find another way to communicate securely. In other words, back door mechanisms will help criminals steal legitimate data and won't help to catch sophisticated criminals.
I think it's okay to use WhatsApp and that your messages are private and encrypted. Since it's a closed source application then, in theory, it might exhibit some unexpected behaviour. Also, since it has such a large user base, it is more likely to be a target for being replaced with a rogue piece of software. But I think that for all practical purposes, these are just theoretical concerns. I can use WhatsApp to communicate with almost anybody for free and I often do. However, I also use Signal and I can imagine there might be a time when its open source nature means I'd prefer to use it over WhatsApp.
Conclusion
It's not only criminals who don't want people reading their communications. If you want to be able to send secure text messages and to speak on a secure line (for free) you should consider using either WhatsApp or Signal from Open Whisper Systems. I use both.
If you found this article interesting or useful (or neither), you can comment below, subscribe for free Azure and SQL ebooks (I daresay you've just seen a pop-up of some kind suggesting you might like to do so. Click here to see it again. I promise not to pester you and you might even win something) or follow me on Twitter (I'll probably follow you back). Follow @TomChantler
Most as in all. ↩︎
Join the newsletter to receive the latest updates in your inbox.
Hire me for consultancy work