[Update: Screenshot] Google Messages preparing end-to-end encryption for RCS messages - 9to5Google

Posted: 26 May 2020 12:00 AM PDT

Today, the folks at APKMirror got ahold of an internal "dogfood" build of Google Messages version 6.2. Here, "dogfood" is used in the sense of the phrase "eat your own dog food," meaning actually use the product you're building. Of course, our APK Insight team immediately dug in to see what all is coming with the next version of Google Messages. While we're still actively looking through the many changes found within, one in particular stood out — end-to-end encryption for RCS messages.

Update 5/26: We now have a screenshot of one of the end-to-end encryption settings pages in action.

About APK Insight: In this "APK Insight" post, we've decompiled the latest version of an application that Google uploaded to the Play Store. When we decompile these files (called APKs, in the case of Android apps), we're able to see various lines of code within that hint at possible future features. Keep in mind that Google may or may not ever ship these features, and our interpretation of what they are may be imperfect. We'll try to enable those that are closer to being finished, however, to show you how they'll look in case that they do ship. With that in mind, read on.

RCS end-to-end encryption

For years now, folks have been excited about RCS messaging as being the true successor to SMS and MMS messages and an open competitor to Apple's iMessage. However, one thing that iMessage has long offered that RCS could not is the ability to know your messages are secure thanks to end-to-end encryption. For an over simplified explanation of end-to-end encryption, your message is encrypted on your device in such a way that it can only be decrypted and read on the recipient's device, meaning no one should be able to snoop on your conversation.

In this dogfood build of Google Messages 6.2, we've found that work is well under way to allow you to send end-to-end encrypted messages via RCS. In fact, there are a total of twelve new strings in the app that make reference to encryption (sometimes shortened to "e2ee").

<string name="encrypted_rcs_message">End-to-End Encrypted Rich Communication Service message</string>

<string name="send_encrypted_button_content_description">Send end-to-end encrypted message</string>

<string name="e2ee_conversation_tombstone">Chatting end-to-end encrypted with %s</string>

<string name="metadata_encryption_status">End-to-end encrypted message</string>

For now, there aren't enough details to know for sure what the exact requirements are for using this end-to-end encryption. It's possible that both parties will need to be using the Google Messages app, though this could change once more apps gain support.

What we do know for certain is that both the sender and recipient will need to have a good internet connection simultaneously for these end-to-end encrypted RCS messages to go through. If either of you has a poor connection, Google Messages will offer to send your message through SMS or MMS as a fallback method. Before sending in this way though, the app will remind you that SMS and MMS are not encrypted and ask for your consent.

<string name="e2ee_fail_to_send_retry_description">Resend as chat</string>

<string name="encryption_fallback_title">Send unencrypted messages?</string>

<string name="encryption_default_fallback_body">"SMS/MMS texts aren't end-to-end encrypted.\n\nTo send with end-to-end encryption, wait for improved data connection or send messages now as SMS/MMS."</string>

<string name="encryption_fallback_dialog_accept_button">Send unencrypted</string>

<string name="encryption_fallback_dialog_decline_button">Wait</string>

<string name="encryption_sent_fallback_body">"SMS/MMS texts aren't end-to-end encrypted.\n\nTo send with end-to-end encryption, wait until %1$s has data connection or send messages now as SMS/MMS."</string>

Interestingly, it looks like Google Messages will also have extra protections in place for your end-to-end encrypted RCS messages. For example, you'll be able to set whether other Android apps that have permission to see your messages can also see your encrypted messages. You'll also be reminded that your messages are encrypted when sharing your location.

<string name="etouffee_to_telephony_setting_title">Let other apps access end-to-end encrypted messages</string>

<string name="location_attachment_picker_send_encrypted_content_description">Send end-to-end encrypted message with selected location %1$s</string>

Update 5/26: Our Dylan Roussel has dug deeper into the new dogfood build and managed to enable some aspects of Google Messages' RCS encryption settings. While we're not yet able to actually send or receive encrypted messages, the settings confirm some of what we already learned. Specifically, we can now see a global toggle that decides whether or not third-party apps can read your encrypted messages.

We've also found that encrypted messages may have a prefix added by the Google Messages app, currently configured to read, "This is an encrypted message." For now, we're not sure how this will be used, though it could be intended to only be seen if a message's contents have not been decrypted.

As all of this is only just beginning to appear in a "dogfood" build of Google Messages, we still have a bit of waiting to do before end-to-end encryption arrives for RCS. That said, it's clear Google wants RCS to be a legitimate competitor to iMessage, matching it both in features like message reactions for the everyday user and ones like encryption for the more security conscious.

Dylan Roussel contributed to this article

More on Google Messages:

FTC: We use income earning auto affiliate links. More.

Check out 9to5Google on YouTube for more news:

Best apps to share files securely: for safe file-sharing - Tom's Guide

Posted: 06 Jul 2020 12:00 AM PDT

In recent years, cloud storage services have made it easier than ever to share files online. But, while there are plenty of different tools for transferring files over the web, it's not always obvious which platforms are the most secure.

Although password protection and custom file access permissions have been commonplace amongst file-sharing apps for a few years, cloud storage and file transfer services are still vulnerable to hacking attacks. The best thing to do, therefore, is to use a platform that supports end-to-end encryption, guaranteeing that transferred files will only be seen by their intended recipient.

Besides using a platform with in-build security tech, you can also keep your info safe by protecting your files through protocols such as GPG and PGP. With these or other security standards, you can encrypt your files prior to sharing so that only someone with a specific key will be able to open them. However, taking this route may be frustrating or unnecessarily time-consuming, especially if all you want to do is share a couple of documents safely.

To help you find a better solution, we've put together a comprehensive list of the best file-sharing apps that offer file encryption. By using one of these services, you can rest assured that the information you transfer will remain safe and secure.

These are the best apps to share files securely.

(Image credit: pCloud)

1. pCloud

Ideal if you're searching for a secure storage solution in the cloud.

Client-side encryption service available

Tried and tested security

Helpful sharing features

Expensive upfront cost

Additional charge for top-tier encryption

pCloud is a cloud storage platform with advanced file sharing features, such as shared folders, advanced access controls, and direct file links. We recommend this service for safe file-sharing because it encrypts uploaded files, giving your data an additional layer of protection.

The pCloud platform stands out amongst alternative file-sharing platforms because you can pay a one-time $175 to obtain 500GB of lifetime storage, or $350 for 2TB. Although this is a significant investment, in the long run it could save you a lot of cash over paying monthly. If that doesn't appeal, monthly subscription options are also available.

With a standard pCloud cloud storage account, you get access to some great security features, such as 256-bit AES encryption and SSL channel protection. However, if you want to take things to another level, pCloud offers an extra client-side encryption option, known as pCloud Encryption, for a one-time $125 fee.

To demonstrate how secure pCloud Encryption is, the company actually challenged 616 organizations, including Berkley and MIT, to hack their client-side encryption system, offering a $100,000 reward for successful intrusions. Impressively, not one group managed to break in.

Read our full pCloud review.

(Image credit: Enigmail)

2. Enigmail

The best tool for email protection

Often, the most sensitive and confidential information we share over the web is transmitted through email messages and attachments. This makes securing your emailed files and data a high priority, and Enigmail is an excellent tool to help you do that.

Enigmail is a plugin created specifically for the Thunderbird email client. Thunderbird is a free email management system that can be installed on PC, macOS, Linux, and even FreeBSD machines.

If you use Thunderbird to sync and send emails, you should absolutely install Enigmail. The plugin uses the OpenPGP email encryption standard to secure and digitally sign any emails you send or receive. Like other PGP systems, OpenPGP uses public and private keys to protect your data. A user's public key can be used to encrypt information which only their corresponding private key will be able to decrypt.

The big advantage of using Enigmail is that you don't have to spend time fiddling around with encryption protocols as the plugin can automatically manage encryption and decryption. If you don't feel like making the switch to Thunderbird, you'll find that most popular email management tools have equivalent OpenPGP plugins available.

(Image credit: Signal)

3. Signal

An industry-leading secure messaging tool

Time-limited disappearing messages

Voice and video calls

Totally free

All participants need Signal for encryption to work

App feels plain

If you're looking for a secure way to share files via an instant messenger-style service, Signal is one of the best options out there. It's powered by an encryption engine known as Signal Protocol which secures your messages, calls, and files via end-to-end encryption.

The awesome thing about using an open-source platform like Signal is that anyone can explore and improve the source code behind the tool, meaning any bugs or security weaknesses are quickly identified and patched.

The signal app can be run on pretty much any device, with clients for Android, iOS, Windows, macOS, and Linux. Although the interface isn't particularly exciting, all the functionality you'd get in a regular messaging service is available here, including group chats and video calls, and secure file sharing.

If you're using it on a mobile device, you can even set Signal as a replacement for your default SMS application. However, SMS texts won't be encrypted by Signal as the platform's encryption only functions correctly if you and your recipient both have Signal installed.

(Image credit: LastPass)

4. LastPass

A safe place to store your valuable information online

Protect your passwords

Share account credentials with multiple people

Great multifactor security

File storage isn't free

Storage space is restricted

LastPass, created by LogMeIn, is a handy platform capable of storing all your usernames and passwords and automatically inputting them whenever you need to log in.

One of its most impressive features is the ability to share logins. This is ideal if you need to give someone temporary or permanent access to one of your file storage accounts. And the best part of LastPass's credential sharing feature is that you can let a trusted person access a LastPass-protected account without being able to see your password.

Although LastPass can be used for free, if you upgrade to a $3 per month paid subscription, you'll receive 1GB of encrypted storage space. That might not sound like much, but it's plenty of room if you reserve it for your most precious items, such as passport photocopies and bank account records.

(Image credit: Resilio)

5. Resilio

Secure file syncing across multiple devices

Resilio, which used to be known as BitTorrent Sync, is a file-sharing tool that uses the BitTorrent protocol to sync files between two devices. The reason we recommend this platform for secure file sharing is that files can be transferred directly between your devices, so you don't have to use a vulnerable third-party cloud service.

As long as your source and recipient devices are connected to the web, it's possible to transfer files quickly through Resilio using a connection secured by 128-bit AES encryption. BitTorrent's protocol is particularly suited to transferring large files and batches of files securely.

You can install a version of Resilio, known as Sync Home, for free. However, this cannot be used to send files, just to receive them. To be able to send files, and access other features like multiple-device management, you'll need to upgrade to the Sync Home Pro for a $59.99 one-time fee. Also available is Sync Family Pro which, for $99.99, enables you to sync files with 5 other users.

Corporate users may wish to opt for Sync Business Pro instead. For $30 per month and up, this version of Resilio removes all bandwidth transfer limits. It's also the best version of the platform for secure and safe file-sharing because transferred information is automatically protected through end-to-end encryption.

Search This Blog

Android Full Encryption