META PLATFORMS, INC. By Nicole Nguyen
Two apps -- Signal and Telegram -- are currently the No. 1 and No. 2 free app downloads in Apple's App Store and Google's Play Store. Millions of users flocked to the chat apps in recent weeks, according to data from Apptopia and Sensor Tower. There are a few factors behind the surge.
One is concern over a privacy-policy update for the Facebook Inc.-owned WhatsApp. Meanwhile, the deplatforming of President Trump from prominent social networks following the U.S. Capitol riot has driven people to seek communication tools without moderators and external visibility.
On Jan. 7, Tesla Inc. Chief Executive Elon Musk tweeted, "Use Signal." A subsequent flood of users caused the app's phone-number verification system to break temporarily. Days later, Twitter Inc. CEO Jack Dorsey published a screenshot of Signal at the top of the App Store charts, along with a heart emoji. At the same time, influential accounts on Parler, the social network popular among conservatives, called on followers to move to Telegram. Donald Trump Jr. actively posts in a public channel on the app.
What do Signal and Telegram have in common? Both are chat apps that offer end-to-end encryption outside of Big Tech's grasp. Encrypted messaging apps like Signal and Telegram can offer more security, privacy and features than plain text messaging -- but their encryption methods and data collection vary. Meanwhile, WhatsApp and Apple Inc.'s iMessage also offer end-to-end encryption, but within their respective ecosystems.
Here's how to choose an encrypted chat app, and why you might want to.
Why does encrypted communication matter?
A well-implemented encryption protocol makes messages and calls visible only to the sender and the intended recipient.
The content of that message looks like gibberish to everyone else, including the app's maker, the government and your internet service provider. Sending an encrypted message is like using a sealed envelope instead of a postcard.
It's important to note that encryption doesn't prevent the recipient from forwarding your message or taking a screenshot, or from someone seeing messages by gaining access to your phone. (Make sure your devices are protected by a password or passcode.)
End-to-end encryption is so secure that government officials have historically lambasted the technology, saying the apps make it difficult to track down criminals. Indeed, encryption can protect everyone, including bad actors. In 2018, rumors about kidnapped children that spread on WhatsApp fueled violence and deadly attacks in India. The platform then imposed forwarding limits on messages, hoping to slow the flow of misinformation. Still, the incident proved it's difficult for authorities to quell violence when they can't see what's inciting it.
I often hear from friends and family that they have "nothing to hide," and therefore don't need to keep their texts secret. According to Jennifer King, a privacy and data fellow at Stanford's artificial intelligence institute, "It's not about hiding the communications itself. It's more that there's an overarching sense that the number of digital spaces today where you can assume someone is not collecting data from you is increasingly small." Apps like Signal, which Dr. King uses in addition to iMessage, provide a privacy refuge.
What's the difference between the apps?
I'm focusing on the most popular free platforms. First, there are the two independent ones: Signal, a nonprofit funded largely by WhatsApp co-founder and Facebook former executive Brian Acton; and Telegram, founded and funded by its chief executive, Pavel Durov, an entrepreneur who created Russia's largest social network. Then there are WhatsApp and iMessage, run by two of the biggest big tech companies.
These apps can all work over cellular and Wi-Fi, and host features like audio and video calling, read receipts, typing indicators and threaded replies, plus the ability to send messages from different devices. And yes, they all allow you to communicate in the essential language of the internet: GIFs.
The apps differ in the encryption protocol, the amount of data collected about your device or the nature of the messages themselves (metadata), and the compatible mobile platforms. Since chat apps aren't compatible with one another, you have to get all your friends, family and colleagues on the same app you're on -- or constantly hop between them.
Signal
Pros: Signal is widely regarded as the most private app. Its encryption is open source, which is considered a best practice among cybersecurity professionals. That means the code can be scrutinized for flaws and verified by researchers. It has apps for iPhone, iPad, Mac, Windows and Linux, and privacy-minded features like expiring messages. The app added a number of user-friendly features over the past year, including group video chat for up to eight participants. (Group chats can host up to 1,000 participants.) A 2016 grand jury subpoena resulted in just two data points: the date of an account's creation and the date of last use.
Cons: Even though it's having a moment, it's not as widely adopted as WhatsApp and iMessage. And while Signal is adding more features regularly, it doesn't have WhatsApp's text formatting or location sharing.
Telegram
Pros: Telegram supports up to 200,000 members in a group, which is why it served as the go-to app for protesters in Hong Kong, Iran and Belarus. The app has unique features, like sorting contacts by when they were last seen on the app, and the ability to play voice notes at twice the recorded speed.
Cons: Telegram is often criticized for publishing only select parts of its code for public review. "Telegram may have weaker cryptography than Signal, but it's hard to know because they have been somewhat shady about getting outside audits," said Riana Pfefferkorn, a research scholar at Stanford's Center for Internet and Society.
Telegram spokesman Mike Ravdonikas said the app's encryption and API are "fully documented and open for review by security experts." However, the code for the app's back-end server is not public. A support page states that all code "will be released eventually."
Furthermore, Telegram's encryption is not turned on by default. As with Facebook Messenger, encryption must be turned on for each chat: Tap on a contact's username, select More, and then Start Secret Chat.
Telegram can also collect metadata such as IP address and device information, which the company says is used to prevent spam and abuse in its privacy policy. While it doesn't seem like much, message metadata can serve as evidence.
Pros: WhatsApp uses Signal's peer-reviewed encryption protocol, which keeps the contents of messages secret between its over two billion users. The app is feature-rich -- location sharing, custom wallpapers, the ability to star individual messages, and more.
Cons: The desktop app doesn't work when your phone isn't connected to the internet.
There are also new privacy concerns. A recent update to its terms of service and privacy policy caused an uproar among users who didn't want their data shared with Facebook.
WhatsApp spokesman Carl Woog told me the update affects only users who communicate with businesses on the app. Soon businesses will be allowed to retain customer communications on a Facebook-hosted platform. The change doesn't affect users who opted out of sharing some data with Facebook in 2016, he said.
Additionally, Mr. Woog explained that while Apple's App Store privacy label identifies "location, contacts and user content" as "Data Linked to You," that information isn't necessarily being collected. Data such as your IP address and approximate location are helpful in investigating abuse, he said.
Still, the app is owned by Facebook, and currently shares some information with its parent company, including your phone number and mobile-device information. WhatsApp could, with a warrant, see who you're messaging, but it doesn't keep those records proactively. And it can't see the content of those messages.
iMessage
Pros: Like WhatsApp, iMessage has a massive user base -- it's the default messaging platform on the billion-plus active iPhones and iPads around the world. While you may know it by its app, Messages, iMessage is the platform itself, which manages end-to-end encrypted texts, images and voice notes -- the blue-bubble interactions. (Apple's FaceTime is also encrypted end-to-end.)
Cons: The platform only works on Apple devices. Messages from Android users -- the chats with those green bubbles -- aren't encrypted.
Apple does retain some metadata. Apple checks to see if the phone numbers you enter are iMessage compatible. The number, along with date and time of the lookup, is deleted after 30 days. A company spokeswoman said Apple can't determine whether any communication took place.
(Dow Jones & Co., publisher of The Wall Street Journal, has a commercial agreement to supply news through Apple services.)
-- For more WSJ Technology analysis, reviews, advice and headlines, sign up for our weekly newsletter.
Write to Nicole Nguyen at nicole.nguyen@wsj.com
(END) Dow Jones Newswires
01-13-21 1016ET
