Signal, WhatsApp and Telegram: All the major security differences between messaging apps - CNET
Signal, WhatsApp and Telegram: All the major security differences between messaging apps - CNET |
- Signal, WhatsApp and Telegram: All the major security differences between messaging apps - CNET
- Helpful Strategies to Combat WhatsApp Security Threats - hackernoon.com
- How law enforcement gets around your smartphone’s encryption - Ars Technica
| Signal, WhatsApp and Telegram: All the major security differences between messaging apps - CNET Posted: 19 Feb 2021 04:00 AM PST  If your choice of encrypted messaging app is a toss-up between Signal, Telegram and WhatsApp, do not waste your time with anything but Signal. This isn't about which has cuter features, more bells and whistles or is most convenient to use -- this is about pure privacy. If that's what you're after, nothing beats Signal. By now you probably already know what happened. On Jan. 7, in a tweet heard 'round the world, tech mogul Elon Musk continued his feud with Facebook by advocating people drop its WhatsApp messenger and use Signal instead. Twitter CEO Jack Dorsey retweeted his call. Around the same time, right-wing social network Parler went dark following the Capitol attacks, while political boycotters fled Facebook and Twitter. It was the perfect storm -- the number of new users on Signal and Telegram has surged by tens of millions since. Read more: Everything to know about Signal The jolt also reignited security and privacy scrutiny over messaging apps more widely. Among the three currently dominating download numbers, there are some commonalities. All three are mobile apps available in the Play Store and App Store, and which support cross-platform messaging, have group chat features, offer multifactor authentication, and can be used to share files and photos. They all provide encryption for texting, voice and video calls.  Watch this: Why Signal is surging: Elon Musk 5:06 Signal, Telegram and WhatsApp all use end-to-end encryption in some portion of their app, meaning that if an outside party intercepts your texts, they should be scrambled and unreadable. It also means that the exact content of your messages supposedly can't be viewed by the people working for any of those apps when you are communicating with another private user. This prevents law enforcement, your mobile carrier and other snooping entities from being able to read the contents of your messages, even when they intercept them (which happens more often than you might think). The privacy and security differences between Signal, Telegram and WhatsApp couldn't be bigger, though. Here's what you need to know about each of them. 
Signal is a typical one-tap install app that can be found in your normal marketplaces like Google's Play Store and Apple's App Store and works just like the usual text-messaging app. It's an open-source development provided free of charge by the nonprofit Signal Foundation and has been famously used for years by high-profile privacy icons like Edward Snowden. Signal's main function is that it can send -- to either an individual or a group -- fully encrypted text, video, audio and picture messages, after verifying your phone number and letting you independently verify other Signal users' identity. For a deeper dive into the potential pitfalls and limitations of encrypted messaging apps, CNET's Laura Hautala's explainer is a life-saver. When it comes to privacy, it's hard to beat Signal's offer. It doesn't store your user data. And beyond its encryption prowess, it gives you extended, onscreen privacy options, including app-specific locks, blank notification pop-ups, face-blurring antisurveillance tools and disappearing messages. Occasional bugs have proven that the tech is far from bulletproof, of course, but the overall arc of Signal's reputation and results have kept it at the top of every privacy-savvy person's list of identity protection tools. The Guardian, The Washington Post, The New York Times (which also recommends WhatsApp) and The Wall Street Journal all recommend using Signal to contact their reporters safely. For years, the core privacy challenge for Signal lay not in its technology but in its wider adoption. Sending an encrypted Signal message is great, but if your recipient isn't using Signal, then your privacy may be nil. Think of it like the herd immunity created by vaccines, but for your messaging privacy. Now that Musk's and Dorsey's endorsements have sent a surge of users to get a privacy booster shot, however, that challenge may be a thing of the past. 
Telegram falls somewhere in the middle of the privacy scale, and it stands apart from other messenger apps because of its efforts to create a social network-style environment. While it doesn't collect as much data as WhatsApp, it also doesn't offer encrypted group calls like WhatsApp, nor as much user data privacy and company transparency as Signal. Data collected by Telegram that could be linked to you includes your name, phone number, contact list and user ID. Telegram also collects your IP address, something else Signal doesn't do. And unlike Signal and WhatsApp, Telegram's one-to-one messages aren't encrypted by default. Rather, you have to turn them on in the app's settings. Telegram group messages also aren't encrypted. Researchers found that while some of Telegram's MTProto encryption scheme was open-source, some portions were not, so it's not completely clear what happens to your texts once they're in Telegram's servers. Telegram has seen several breaches. Some 42 million Telegram user IDs and phone numbers were exposed in March of 2020, thought to be the work of Iranian government officials. It would be the second massive breach linked to Iran, after 15 million Iranian users were exposed in 2016. A Telegram bug was exploited by Chinese authorities in 2019 during the Hong Kong protests. Then there was the deep-fake bot on Telegram that has been allowed to create forged nudes of women from regular pictures. Most recently, its GPS-enabled feature allowing you to find others near you has created obvious problems for privacy. I reached out to Telegram to find out whether there were any major security plans in the works for the app, and what its security priorities were after this latest user surge. I'll update this story when I hear back. 
Let's be clear: There's a difference between security and privacy. Security is about safeguarding your data against unauthorized access, and privacy is about safeguarding your identity regardless of who has access to that data. On the security front, WhatsApp's encryption is the same as Signal's, and that encryption is secure. But that encryption protocol is one of the few open-source parts of WhatsApp, so we're being asked to trust WhatsApp more than we are Signal. WhatsApp's actual app and other infrastructure have also faced hacks, just as Telegram has. Jeff Bezos' phone was famously hacked in January of 2020 through a WhatsApp video message. In December of the same year, Texas' attorney general alleged -- though has not proven -- that Facebook and Google struck a back-room deal to reveal WhatsApp message content. A spyware vendor targeted a WhatsApp vulnerability with its software to hack 1,400 devices, resulting in a lawsuit from Facebook. WhatsApp's unencrypted cloud-based backup feature has long been considered a security risk by privacy experts and was one way the FBI got evidence on notorious political fixer Paul Manafort. To top it off, WhatsApp has also become known as a haven for scam artists and malware purveyors over the years (just as Telegram has attracted its own share of platform abuse, detailed above). Despite the hacks, it's not the security aspect that concerns me about WhatsApp as much as the privacy. I'm not eager for Facebook to have yet another piece of software installed on my phone from which it can cull still more behavioral data via an easy-to-use app with a pretty interface and more security than your regular messenger. When WhatsApp says it can't view the content of the encrypted messages you send to another WhatsApp user, what is doesn't say is that there's a laundry list of other data that it collects that could be linked to your identity: Your unique device ID, usage and advertising data, purchase history and financial information, physical location, phone number, your contact information and that of your list of contacts, what products you've interacted with, how often you use the app, and how it performs when you do. The list goes on. This is way more than Signal or Telegram. When I asked the company why users should settle for less data privacy, a WhatsApp spokesperson pointed out that it limits what it does with this user data, and that the data collection only applies to some users. For instance, financial transaction data collection would be relevant only to those WhatsApp users in Brazil, where the service is available. "We do not share your contacts with Facebook, and we cannot see your shared location," the WhatsApp spokesperson told CNET. "While most people use WhatsApp just to chat with friends and family, we've also begun to offer the ability for people to chat with businesses to get help or make a purchase, with health authorities to get information about COVID, with domestic violence support agencies, and with fact checkers to provide people with the ability to get accurate information," the spokesperson said. "As we've expanded our services, we continue to protect people's messages and limit the information we collect." Is WhatsApp more convenient than Signal and Telegram? Yes. Is it prettier? Sure. Is it just as secure? We won't know unless we see more of its source code. But is it more private? Not when it comes to how much data it collects comparatively. For real privacy, I'm sticking with Signal and I recommend you do the same.  |
| Helpful Strategies to Combat WhatsApp Security Threats - hackernoon.com Posted: 18 Feb 2021 10:28 AM PST   @shigraf-aijazshigraf AijazI am a cybersecurity journalist who has a knack for following emerging technology. In the previous year, a security flaw was found in the WhatsApp desktop version. It allowed cyber-crooks to push malware or deploy codes by using harmless messages.
More than 1.5 billion people use the desktop platform every month. The bug can impact all these users for the iPhone if they don't update their devices and still use the Chrome browser's old version. Malicious actors can also inject some harmful codes or links that cause unsuspected users to click on those links that look like a friend's message.
WhatsApp Web MalwareThere are more than two billion WhatsApp users worldwide, making it a target for cyber-criminals. WhatsApp has always allowed you to download any desktop app, open a website, scan a code with the app on your smartphone, and use WhatsApp on your computer. The app store within your device, either the App Store and Google Play, is much more carefully regulated than the internet. When you search for WhatsApp on these stores, it's evident which app is the official one. But, it isn't right for the full internet.
Some hackers often try a different approach like reverse engineering. The main purpose is to fool you into giving away your personal information. Most of these sites pretend to be a WhatsApp Web, asking you to provide your contact number to connect to their service. But, they use the number to link with other hacked or leaked data over the internet. Unencrypted BackupsThe messages sent by you on WhatsApp are protected by end-to-end encryption. It means that you and the recipient can decode it. These features stop your message from being seized during transmission, even by Facebook. But, this doesn't protect them once they decrypted it on your device. WhatsApp platform permits you for messages and media on Android and iOS. It is a vital feature because it allows you to restore your messages. Additionally, to cloud-based backup, there is a local backup on your phone as well. You can back up your data on either Google Drive or iCloud if you're an iPhone user. The backups have the decrypted messages from your device. But, the backup file stored on your desired location isn't encrypted.
Data Sharing Through FacebookWhatsApp updated its Privacy Policy back during the start of this year, for which they were criticized too, and it is again in the reviewing phase. In 2016, the company allowed sharing of data from WhatsApp to Facebook. Even though they avoid revealing the entire extent of this data transfer, it includes your phone number and usage data. It gives rise to a new WhatsApp vulnerability, which puts your WhatsApp messages at significant risk. They stated that your information would be publicly visible on Facebook, indicating that it would be hidden in Facebook's inaccessible profile. The company faced severe backlash on this announcement. As a result, WhatsApp allows its users to manage their data sharing arrangements. But, after some time, they removed this option without the consent of the other. The New York Times reported that Facebook has started to make a unified infrastructure for its messaging channels. It would integrate Facebook, Instagram, and WhatsApp. Because each service seems to be a separate app, the messages will be sent on the same network. Media File JackingMedia file jacking is yet another security vulnerability faced by WhatsApp. It takes advantage of how apps receive media files such as photos or videos and writes those files to the device's external storage.
Tips for WhatsApp Security and PrivacyAlthough WhatsApp is among the biggest instant messaging apps (millions, in fact, in billions of people, use WhatsApp), considering the threats mentioned above, everyone needs to remain safe. Adopt the practices mentioned below to ensure their online safety and security. Here are seven tips to protect yourself from hackers on WhatsApp: 1. Enable Security Notifications Whenever a new phone or a laptop accesses any existing chat, a security code is generated, which is a new one. WhatsApp can send you a notification when the security code is changed. In this way, you can check the encryption with anyone you chat with over a different messenger to ensure your online security. To do so, switch on your security notifications. Go to WhatsApp> Settings> Account> Security> Show Security Notifications and swipe the button towards the right. 2. Enable Multi-Factor Verification Enabling multi-factor authentication on your device adds an extra layer of passcode to your app and ensures that your data can't be accessed by anyone other than you. To activate this feature, visit Menu> Settings> Account> 2FA verification> Enable. By following some steps, you come up with a six-digit PIN code that is remembered. Add your email address to get back the code in case you forget it. 3. Lock Your WhatsApp Screen The lock screen option is available on almost all Android devices. It ensures that no one except for you can open your WhatsApp account. Visit the Settings Menu> Privacy> Select the Screen Lock option. All you have to do is insert and register your fingerprint, and once the process is completed, you've to scan your fingerprint each time you open WhatsApp. 4. End-to-End Encryption All WhatsApp users should make sure that their chats are end-to-end encrypted. Verify that your conversation is encrypted by tapping on the contact info screen's name, tap on encryption to view the QR code and 60-digit number. WhatsApp encryption guarantees that only you and your recipient can read the messages that are being exchanged, and even WhatsApp is incapable of doing so. Thus, don't neglect this feature. 5. Avoid Clicking on Suspicious Links To protect yourself from WhatsApp vulnerabilities, prevent clicking on any suspicious-looking links by any sender. In fact, before clicking on any link, get to know what the link is all about. Ask your contact what the link is all about. In most cases, such links contain malware, which risks it at considerable risks after downloading it to your phone. Don't forget the famous incident when Amazon CEO's phone got hacked through a video file. Next time, when you come across any such link, remember this occasion when one of the renowned person's phones got hacked if this can happen to influential people, so why not anyone like you. 6. Look Out for Scams Remember, WhatsApp never contacts you on the app. It never sends any email about chats, photos, videos, and voice messages unless you've mailed them for any help or support. Anything given for free subscription and claims to be from WhatsApp is a scam so, be careful and avoid it. 7. Don't Forget to Log Out from WhatsApp Web Many users are not aware that they should log out of the WhatsApp web on the Google Chrome browser from their mobile or the browser. If you don't logout then, it's easy for anyone to access all your WhatsApp messages. Thus, always log out once you stop using the app from the web. Parting WordsWhatsApp security has grown as a significant concern for every user. There are more vulnerabilities and threats to come to light in the upcoming time. All you need to do is adopt and follow the security practices, as mentioned earlier, to protect yourself from hackers' clutches. Related 5 reactions  6 reactions  TagsJoin Hacker Noon Create your free account to unlock your custom reading experience.  |
| How law enforcement gets around your smartphone’s encryption - Ars Technica Posted: 15 Jan 2021 12:00 AM PST  Enlarge / Uberwachung, Symbolbild, Datensicherheit, Datenhoheit Westend61 | Getty Images Lawmakers and law enforcement agencies around the world, including in the United States, have increasingly called for backdoors in the encryption schemes that protect your data, arguing that national security is at stake. But new research indicates governments already have methods and tools that, for better or worse, let them access locked smartphones thanks to weaknesses in the security schemes of Android and iOS. Cryptographers at Johns Hopkins University used publicly available documentation from Apple and Google as well as their own analysis to assess the robustness of Android and iOS encryption. They also studied more than a decade's worth of reports about which of these mobile security features law enforcement and criminals have previously bypassed, or can currently, using special hacking tools. The researchers have dug into the current mobile privacy state of affairs and provided technical recommendations for how the two major mobile operating systems can continue to improve their protections. "It just really shocked me, because I came into this project thinking that these phones are really protecting user data well," says Johns Hopkins cryptographer Matthew Green, who oversaw the research. "Now I've come out of the project thinking almost nothing is protected as much as it could be. So why do we need a backdoor for law enforcement when the protections that these phones actually offer are so bad?" Before you delete all your data and throw your phone out the window, though, it's important to understand the types of privacy and security violations the researchers were specifically looking at. When you lock your phone with a passcode, fingerprint lock, or face recognition lock, it encrypts the contents of the device. Even if someone stole your phone and pulled the data off it, they would only see gibberish. Decoding all the data would require a key that only regenerates when you unlock your phone with a passcode, or face or finger recognition. And smartphones today offer multiple layers of these protections and different encryption keys for different levels of sensitive data. Many keys are tied to unlocking the device, but the most sensitive require additional authentication. The operating system and some special hardware are in charge of managing all of those keys and access levels so that, for the most part, you never even have to think about it. With all of that in mind, the researchers assumed it would be extremely difficult for an attacker to unearth any of those keys and unlock some amount of data. But that's not what they found.  When an iPhone has been off and boots up, all the data is in a state Apple calls "Complete Protection." The user must unlock the device before anything else can really happen, and the device's privacy protections are very high. You could still be forced to unlock your phone, of course, but existing forensic tools would have a difficult time pulling any readable data off it. Once you've unlocked your phone that first time after reboot, though, a lot of data moves into a different mode—Apple calls it "Protected Until First User Authentication," but researchers often simply call it "After First Unlock." If you think about it, your phone is almost always in the AFU state. You probably don't restart your smartphone for days or weeks at a time, and most people certainly don't power it down after each use. (For most, that would mean hundreds of times a day.) So how effective is AFU security? That's where the researchers started to have concerns. The main difference between Complete Protection and AFU relates to how quick and easy it is for applications to access the keys to decrypt data. When data is in the Complete Protection state, the keys to decrypt it are stored deep within the operating system and encrypted themselves. But once you unlock your device the first time after reboot, lots of encryption keys start getting stored in quick access memory, even while the phone is locked. At this point an attacker could find and exploit certain types of security vulnerabilities in iOS to grab encryption keys that are accessible in memory and decrypt big chunks of data from the phone. Based on available reports about smartphone access tools, like those from the Israeli law enforcement contractor Cellebrite and US-based forensic access firm Grayshift, the researchers realized that this is how almost all smartphone access tools likely work right now. It's true that you need a specific type of operating system vulnerability to grab the keys—and both Apple and Google patch as many of those flaws as possible—but if you can find it, the keys are available, too. The researchers found that Android has a similar setup to iOS with one crucial difference. Android has a version of "Complete Protection" that applies before the first unlock. After that, the phone data is essentially in the AFU state. But where Apple provides the option for developers to keep some data under the more stringent Complete Protection locks all the time—something a banking app, say, might take them up on—Android doesn't have that mechanism after first unlocking. Forensic tools exploiting the right vulnerability can grab even more decryption keys, and ultimately access even more data, on an Android phone. Tushar Jois, another Johns Hopkins PhD candidate who led the analysis of Android, notes that the Android situation is even more complex because of the many device makers and Android implementations in the ecosystem. There are more versions and configurations to defend, and across the board users are less likely to be getting the latest security patches than iOS users. "Google has done a lot of work on improving this, but the fact remains that a lot of devices out there aren't receiving any updates," Jois says. "Plus different vendors have different components that they put into their final product, so on Android you can not only attack the operating system level, but other different layers of software that can be vulnerable in different ways and incrementally give attackers more and more data access. It makes an additional attack surface, which means there are more things that can be broken." The researchers shared their findings with the Android and iOS teams ahead of publication. An Apple spokesperson told WIRED that the company's security work is focused on protecting users from hackers, thieves, and criminals looking to steal personal information. The types of attacks the researchers are looking at are very costly to develop, the spokesperson pointed out; they require physical access to the target device and only work until Apple patches the vulnerabilities they exploit. Apple also stressed that its goal with iOS is to balance security and convenience. "Apple devices are designed with multiple layers of security in order to protect against a wide range of potential threats, and we work constantly to add new protections for our users' data," the spokesperson said in a statement. "As customers continue to increase the amount of sensitive information they store on their devices, we will continue to develop additional protections in both hardware and software to protect their data." Similarly, Google stressed that these Android attacks depend on physical access and the existence of the right type of exploitable flaws. "We work to patch these vulnerabilities on a monthly basis and continually harden the platform so that bugs and vulnerabilities do not become exploitable in the first place," a spokesperson said in a statement. "You can expect to see additional hardening in the next release of Android." To understand the difference in these encryption states, you can do a little demo for yourself on iOS or Android. When your best friend calls your phone, their name usually shows up on the call screen because it's in your contacts. But if you restart your device, don't unlock it, and then have your friend call you, only their number will show up, not their name. That's because the keys to decrypt your address book data aren't in memory yet. The researchers also dove deep into how both Android and iOS handle cloud backups—another area where encryption guarantees can erode. "It's the same type of thing where there's great crypto available, but it's not necessarily in use all the time," Zinkus says. "And when you back up, you also expand what data is available on other devices. So if your Mac is also seized in a search, that potentially increases law enforcement access to cloud data." Though the smartphone protections that are currently available are adequate for a number of "threat models" or potential attacks, the researchers have concluded that they fall short on the question of specialized forensic tools that governments can easily buy for law enforcement and intelligence investigations. A recent report from researchers at the nonprofit Upturn found nearly 50,000 examples of US police in all 50 states using mobile device forensic tools to get access to smartphone data between 2015 and 2019. And while citizens of some countries may think it is unlikely that their devices will ever specifically be subject to this type of search, widespread mobile surveillance is ubiquitous in many regions of the world and at a growing number of border crossings. The tools are also proliferating in other settings like US schools. As long as mainstream mobile operating systems have these privacy weaknesses, though, it's even more difficult to explain why governments around the world—including the US, UK, Australia, and India—have mounted major calls for tech companies to undermine the encryption in their products. This story originally appeared on wired.com.  |
| You are subscribed to email updates from "encrypt galaxy s7,encrypted cell,what does encrypting my phone do" - Google News. To stop receiving these emails, you may unsubscribe now. | Email delivery powered by Google |
| Google, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States | |
Comments
Post a Comment