As the self-inflicted WhatsApp backlash continues, millions have turned to Signal and Telegram instead. But how much do you know about these rival messengers? Given the headlines, you’d assume they’re both more secure than WhatsApp, right? Actually, wrong. So, if you’re considering a switch, here are three things you need to know.
By now you’ll be all too familiar with the train wreck series of events that has led to millions of WhatsApp users switching to alternatives. First, Apple’s privacy labels highlighted the extensive metadata collected by WhatsApp from its 2 billion users. WhatsApp complained, saying it was unfair that Apple’s own iMessage didn’t have a privacy label—Apple then published exactly that, which made WhatsApp look worse.
APPLE APP STORE ‘PRIVACY LABELS’
That privacy label issue would have been contained, but, in its midst, WhatsApp decided to force a change of terms on all its users. The driver behind this was to facilitate Facebook business customers communicating with and selling to WhatsApp users. No real security or privacy issues. But the change was clumsily worded, which led to it being misreported as WhatsApp sharing private user data with Facebook.
WhatsApp belatedly tried to clarify first the purpose of its metadata collection and then the reasons for its changed terms of service. But the damage had been done. A week later, Signal and Telegram have been the main beneficiaries from WhatsApp’s mishaps. If you’re one of the millions that have already switched or you’re considering doing so, then this might help you decide whether to make a move and to where.
1. Are you really more secure if you switch to Signal or Telegram?
The WhatsApp backlash has focused on its collection of metadata—the who, when and where of a message rather than its content. And while the platform denies sharing anything private or sensitive with Facebook, it still collects too much. What hasn’t been questioned, though, is the security it applies to your messages themselves.
WhatsApp popularized end-to-end encryption, where only the sender and recipients of a message can read its contents, and it deserves great credit for this and for defending the use of such security despite the efforts of lawmakers to mandate backdoors. Yes, there have been examples of WhatsApp’s security being compromised, most famously by alleged Israeli spyware in 2019, but these are endpoint compromises—attacks on phones, not weaknesses in WhatsApp’s own infrastructure.
Signal’s security is better than WhatsApp’s. Both use Signal’s encryption protocol, but whereas Signal’s is fully opensource, meaning it can be examined for vulnerabilities by security researchers, WhatsApp uses its own proprietary deployment. But both are end-to-end encrypted—your content is safe. WhatsApp’s main security weakness is its cloud backup option, which stores your chat history, absent end-to-end encryption in Google’s or Apple’s cloud. Signal does not offer any such option, for security reasons.
The situation with Telegram is very different. Ironically, users moving from WhatsApp to Telegram are making a regressive move from a security standpoint. Telegram does not offer end-to-end encryption by default. There is a “secret chat” option, where one user can message another using end-to-end encryption between the two devices and bypassing Telegram’s cloud, but this does not extend to groups.
Signal and Telegram soaring
APPLE APP STORE
The encryption issue makes it difficult to recommend Telegram from a pure security point of view. The lack of default end-to-end encryption “gives users a false sense of privacy,” warns security analyst John Opdenakker. Technically, Telegram can access your messages, which are stored on its servers, backed up to its cloud, and to which it holds the key. MTProto, the encryption protocol used by Telegram, is proprietary and only partly opensource. In reality, you can trust Telegram with your content and there are no serious claims to the contrary, but that’s different from a provider technically unable to access your content, even if they want to.
If security is your concern, then…
