If you’re a regular reader of this column, you know that it’s not paranoia when I say that the Internet is a nest of snakes. Malicious parties are constantly probing and monitoring, mostly automatically, allowing the slighest weakness to be exploited.
The best way to avoid the venom of vipers is to wear a fang-proof suit: end-to-end encryption that lets your data pass across the Internet with very little to practically no chance of interception, depending on the choices you make.
As part of an ongoing series of how to secure your systems and data as if you woke up and found yourself a dissident in the country in which you live, this column looks into how you can evaluate the tools that are available and make the best choices of which to use.
Protect messaging
Many messaging systems promise to keep you secure, while some don’t even mention it. All vary in terms of how well they tick all the boxes necessary to prevent outside interception. I used to refer people at this point to the Electronic Frontier Foundation’s Secure Messaging Scorecard, but the organization says the data is out of date.
It’s still a good basis for the right criteria, though, as the EFF identified seven elements that a secure messaging system should offer.
- Encrypted in transit? No one can intercept the data between user endpoints.
- Encrypted so the provider can’t read it? The provider has to create a system that securely creates or distributes encryption elements it can’t access.
- Can you verify contacts’ identities? Various methods exist for this, but it often involves a cryptographic fingerprint that, if forged, would be detected by the software.
- Are past communications secure if your keys are stolen? This covers intercepted encrypted message data, and whether an outside party could later go back and extract your messages from it.
The other three elements relate to design and review: whether the code has been reviewed by outside parties, independent of the company; whether the code has been recently audited for flaws and exploits; and whether the security design was throughly documented, allowing outsiders to understand the choices made.
Unfortunately, iMessage doesn’t meet all of these tests, although it’s quite good in many ways, and is assumed at this point to be reliable. Researchers fear that some outdated cryptographic choices coupled with a lack of independent review means iMessage may be vulnerable to attack and that Apple could make changes without users being aware that would allow it to intercept message data. No one alleges Apple has done this, but the system design and oversight as it stands allows for it.
Signal lets you exchange safety numbers with someone else in a conversation to ensure no one else is listening in after the conversation begins.
Signal from Open Whisper Systems is the current hands-down winner for secure messaging, including texts, voice calls, and media. It’s free on all platforms, and available for iOS and Android, and comes in a Chrome browser app version for desktop use. Signal is tied to a phone number for authorization, but all messaging happens via secured connections between devices.
Open Whisper Systems makes Signal’s components available as free and open-source code that can be audited and verified, and elements have been incorporated into other apps, like WhatsApp. (WhatsApp can be made secure, but it requires configuration and awareness to prevent using it in a less secure way.)
Signal relies on your contacts to show who is available by default for you to communicate with, as it can check phone numbers (which it uploads to its servers and then deletes) to match other registered users. You can skip this and enter numbers of people manually.
By default, Signal lets you start conversations with other people who use Signal without verifying their identity, but after you exchange the first message, you can use a built-in method. Each conversation on Signal creates a set of cryptographically generated “safety numbers.” You can verify those with the other party through a method that lets you know it’s really who you think it is. That might be a phone call or an in-person meeting, or another secure method you might already have set up. (EFF offers an illustrated guide on how to verify; see the heading “How to Verify your Contacts.”
If the safety numbers ever change, which can happen if someone has to re-register their account or there’s a man-in-the-middle attack, you’ll be alerted and can take action. Someone attempting this sort of change doesn’t have access to the past conversations.
Signal also lets you expire conversations by choosing a Disappearing Messages setting for a given conversation. With that in place, the messages are deleted both on your device and the remote party’s after the specified period of time.
This exposes a bit of information about you, because you have to use your phone number and contacts’ numbers as the defining characteristic. I’ll write in future columns how to send messages securely without using any personal details.
Networking protection limited to end points, not end to end
It might seem like a bit of hassle to use a system like Signal or another that meets the end-to-end security bar instead of securing everything that enters and leaves your device or network via a virtual private network (VPN) connection. Something like a VPN has been around for decades, and in the current form for nearly 20 years.
The basic idea is that software on a computer, mobile, or router creates a connection with a VPN server elsewhere and uses strong encryption and various methods of validation to prevent any potentially intercepted data from being useful to another party.
But VPNs have a distinct limitation. The modern flavor intended to let employees of companies and other organizations work remotely but connect to corporate intranets. One end point would be a user device and the other a server beyond the corporate firewall or other boundary. The termination of both points would be secure.
For most of us, however, when we use a VPN for hire, one like Cloak or TunnelBear, which I’ve reviewed in the past, the termination point for all your Internet interaction is a server in a data center somewhere else in the world.
This protects a lot of legs between you and the rest of the world: the local network, the intermediate connection from that network’s router to an Internet service provider, the ISP to a network backbone, and on to the data center. But whatever you’re engaged in that’s not encrypted separately from the VPN is sent in the clear from the VPN’s data center server to whatever destination it’s headed for: a Web server, an email server, and os on.
In future columns, I’ll look into ways you can work around this limitation, and obtain more end-to-end encryption to generally available Internet services.
Author: Glenn Fleishman, Senior Contributor
Glenn Fleishman’s most recent books include Take Control of iOS and iPadOS Privacy and Security, Take Control of Calendar and Reminders, and Take Control of Securing Your Mac. In his spare time, he writes about printing and type history. He’s a senior contributor to Macworld, where he writes Mac 911.