End-to-end Encryption (Messaging)

End-to-End encryption (E2EE) is quickly being adopted by more messaging applications as users become more conscious of how secure their digital communications become. The cryptography of each application works differently, but the concept of E2EE is similar for each application. When two users begin a conversation on an E2EE application, a private/public key combination is generated; when messages are sent, the message is encrypted using the public key on the senders' device. Now the encrypted packet can be sent to the server to be delivered to the recipient; only when the message reaches the recipient with the correct private key can the message be decrypted and read. Most End-to-End encrypted messaging applications claim that “Messages are end-to-end encrypted. No one outside of this chat, not even [messaging service], can read or listen to them, ” each service has a different privacy policy that fundamentally changes the amount of privacy afforded to the users. There is little clarity given to the consumer on how secure their data is after it has reached the recipient and, for example, how each company deals with violations of their terms of service or if there are governmental requests for the information. This article seeks to provide information to potential users about the fine print contained within the privacy policy of the applications that promise to keep our messages and personal data safe.

Signal

Signal messenger was initially released on iOS in 2014 and Android in 2015 by Open Whisper Systems (OWS) after combining their existing technologies of RedPhone and Text Secure Signal was the first free service to allow users to make end-to-end encrypted calls, something that would have cost ~4¢/minute on the next cheapest service in 2014.

PRivacy Policies

From the outset, Open Whisper Systems was committed to keeping its users' information private and secure. The service was designed so that OWS could only see when a users’ account had been created, the phone number linked to the account, and when they had last connected to the Signal Servers . Signal can offer privacy that other end-to-end encrypted messaging platforms cannot because it is built as an open-source project; collectively built by developers who are concerned about their privacy and will look for bugs and loopholes that are present within the service.

Governmental Pressures

OWS stood firm on their core values, and in October of 2016 when they received their first subpoena for data on one of their users . The Federal Bureau of Investigation subpoenaed Signal for the records of two individuals who were using Signal as their main form of communication to run a crime ring. Signal did comply with the demand for information, but they were very limited in the information that they were able to provide. Signal only collects data on

1. The phone number used to create the account,
2. The time that the account was created and,
3. The last time that the account was connected to the Signal Servers

Creation Of The Signal Technology Foundation

In 2018, Moxie Marlinspike and WhatsApp co-founder Brian Acton announced the formation of the Signal Technology Foundation, whose mission is "to support, accelerate, and broaden Signal's mission of making private communication accessible and ubiquitous" . During this time the Signal Foundation continued on their mission of creating a more accessible private communication system by including support for more devices, still at no cost to the end user. As Signal continued to work on building a private communication system, it started to gain more traction, especially during the George Floyd and subsequent Black Lives Matters protests of 2020. Protesters were worried about how the United States government and police forces would react, and they knew that Signal was time tested in not releasing user data. Organizers were concerned about the privacy policies of competing applications like WhatsApp because “WhatsApp is owned by Facebook, so it makes money off of who is talking to whom, when.” In addition to having the most secure privacy policy, Signal has other features that make it popular among people trying to avoid government oversight, like automatically blurring people's faces in photos.

Signal Protocol

The Signal Foundation (Open Whisper Systems at the time) created the Signal Protocol (formerly TextSecure protocol), an open-source, non-federated cryptographic standard used to encrypt all calls and texts within Signal. The signal protocol is constantly being upgraded to allow developers to incorporate more privacy features in the products they create, including sealed sender which encrypts everything except the address the message is supposed to arrive at, further protecting the users. Numerous closed-source applications have adopted the Signal Standard, including WhatsApp , (some of) Google Rich Communication Services , Facebook Messenger (secret conversations only) , and Skype Private Conversations . Despite private companies using the Signal Cryptographic Standard, they can choose how much metadata they wish to encrypt in the packet, allowing companies to collect more data on their users than what Signal does.

WhatsApp

WhatsApp is an encrypted messaging service that is now owned by Meta (parent company of Facebook). WhatsApp was originally launched in February 2009 as a free service that allowed users to share their statuses with friends; the company followed the principle, “No Ads! No Games! No Gimmicks! – Brian Acton”. The service began to be revolutionized when, in June of 2009, Apple added Push Notification functionality to their iOS operating system. WhatsApp utilized push notifications to share with friends when someone’s status was updated, and this quickly turned into a pseudo-messaging service. With this new-found capability, WhatsApp 2.0 was released in August 2009 with the addition of instant messaging. At this point, WhatsApp transitioned to a $1 yearly subscription model to cover the costs of ad-free messaging and SMS verification . The app gained traction with it’s instant messaging service and grew from 10 million monthly active users to 465 million from October 2010 thru February 2014 . In February 2014, Facebook (now Meta) acquired WhatsApp for $19 billion. This led to another change in the business model of WhatsApp. The messaging service became freeware, and some user data was shared with their parent company, including account phone number, name, statuses, and profile picture. Once Facebook acquired WhatsApp, monthly active users skyrocketed until February 2016, when the app reached 1.00 billion active users . With more than a billion active users, Facebook decided to fully encrypt the service using the Signal Protocol . This change was due to reports of sensitive information being breached in one-on-one and group chats. In a statement from the WhatsApp when end-to-end encryption was released, they include that “every call you make, and every message, photo, video, file, and voice message you send, is end-to-end encrypted by default, including group chats,” however they make no mention of encrypting other information sent between the users’ device and the company.