Are private conversations truly private? A cybersecurity expert explains how end-to-end encryption protects you
- Written by Robin Chataut, Assistant Professor of Cybersecurity and Computer Science, Quinnipiac University
Imagine opening your front door wide and inviting the world to listen in on your most private conversations. Unthinkable, right? Yet, in the digital realm, people inadvertently leave doors ajar, potentially allowing hackers, tech companies, service providers and security agencies to peek into their private communications.
Much depends on the applications you use and the encryption standards[1] the apps uphold. End-to-end encryption[2] is a digital safeguard for online interactions. It’s used by many of the more popular messaging apps. Understanding end-to-end encryption is crucial for maintaining privacy in people’s increasingly digital lives.
While end-to-end encryption effectively secures messages, it is not foolproof against all cyberthreats[3] and requires users to actively manage their privacy settings. As a cybersecurity researcher[4], I believe that continuous advancements in encryption are necessary to safeguard private communications as the digital privacy[5] landscape evolves.
How end-to-end encryption works
When you send a message via an app using end-to-end encryption, your app acts as a cryptographer and encodes your message with a cryptographic key[6]. This process transforms your message into a cipher[7] – a jumble of seemingly random characters that conceal the true essence of your message.
This ensures that the message remains a private exchange between you and your recipient, safeguarded against unauthorized access, whether from hackers, service providers or surveillance agencies. Should any eavesdroppers[8] intercept it, they would see only gibberish and would not be able to decipher the message without the decryption key[9].
When the message reaches its destination, the recipient’s app uses the corresponding decryption key to unlock the message. This decryption key, securely stored on the recipient’s device, is the only key capable of deciphering the message, translating the encrypted text back into readable format.
This form of encryption is called public key, or asymmetric, cryptography[12]. Each party who communicates using this form of encryption has two encryption keys, one public and one private. You share your public key with whoever wants to communicate securely with you, and they use it to encrypt their messages to you. But that key can’t be used to decrypt their messages. Only your private key, which you do not share with anyone, can do that.
In practice, you don’t have to think about sharing keys. Messaging apps that use end-to-end encryption handle that behind the scenes. You and the party you are communicating securely with just have to use the same app.
Who has end-to-end encryption
End-to-end encryption is used by major messaging apps and services to safeguard users’ privacy.
Apple’s iMessage[13] integrates end-to-end encryption for messages exchanged between iMessage users, safeguarding them from external access. However, messages sent to or received from non-iMessage users such as SMS texts to or from Android phones do not benefit from this level of encryption.
Google has begun rolling out end-to-end encryption for Google Messages[14], the default messaging app on many Android devices. The company is aiming to modernize traditional SMS with more advanced features, including better privacy. However, this encryption is currently limited to one-on-one chats.
Facebook Messenger[15] also offers end-to-end encryption, but it is not enabled by default. Users need to start a “Secret Conversation[16]” to encrypt their messages end to end. End-to-end encrypted chats are currently available only in the Messenger app on iOS and Android, not on Facebook chat or messenger.com.
WhatsApp[17] stands out for its robust privacy features, implementing end-to-end encryption by default for all forms of communication within the app.
Signal[18], often heralded by cybersecurity experts as the gold standard for secure communication, offers end-to-end encryption across all its messaging and calling features by default. Signal’s commitment to privacy is reinforced by its open-source protocol, which allows independent experts to verify its security.
Telegram[19] offers a nuanced approach to privacy. While it provides strong encryption, its standard chats do not use end-to-end encryption. For that, users must initiate “Secret Chats[20].”
It’s essential to not only understand the privacy features offered by these platforms but also to manage their settings[21] to ensure the highest level of security each app offers. With varying levels of protection across services, the responsibility often falls on the user to choose messaging apps wisely and to opt for those that provide end-to-end encryption by default.
Messages sent via iMessage are securely encrypted and appear in blue text bubbles. If iMessage isn’t enabled, you can still communicate using SMS/MMS, but these messages lack encryption and display in green text bubbles.
Courtesy Apple[22]
Is end-to-end encryption effective?
The effectiveness of end-to-end encryption in safeguarding privacy is a subject of much debate. While it significantly enhances security, no system is entirely foolproof. Skilled hackers with sufficient resources, especially those backed by security agencies, can sometimes find ways around it.
Additionally, end-to-end encryption does not protect against threats posed by hacked devices[23] or phishing attacks[24], which can compromise the security of communications.
The coming era of quantum computing[25] poses a potential risk to end-to-end encryption, because quantum computers could theoretically break current encryption methods, highlighting the need for continuous advancements in encryption technology.
Nevertheless, for the average user, end-to-end encryption offers a robust defense against most forms of digital eavesdropping and cyberthreats. As you navigate the evolving landscape of digital privacy, the question remains: What steps should you take next to ensure the continued protection of your private conversations in an increasingly interconnected world?
References
- ^ encryption standards (www.passcamp.com)
- ^ End-to-end encryption (www.ibm.com)
- ^ cyberthreats (www.cisa.gov)
- ^ cybersecurity researcher (scholar.google.com)
- ^ digital privacy (www.enzuzo.com)
- ^ cryptographic key (www.thesslstore.com)
- ^ cipher (www.hypr.com)
- ^ eavesdroppers (www.fortinet.com)
- ^ decryption key (sensorstechforum.com)
- ^ MarcT0K/Wikimedia (commons.wikimedia.org)
- ^ CC BY (creativecommons.org)
- ^ public key, or asymmetric, cryptography (ssd.eff.org)
- ^ iMessage (www.apple.com)
- ^ Google Messages (support.google.com)
- ^ Facebook Messenger (about.fb.com)
- ^ Secret Conversation (parentzone.org.uk)
- ^ WhatsApp (faq.whatsapp.com)
- ^ Signal (signal.org)
- ^ Telegram (telegram.org)
- ^ Secret Chats (core.telegram.org)
- ^ manage their settings (www.telemessage.com)
- ^ Courtesy Apple (support.apple.com)
- ^ hacked devices (www.seciron.com)
- ^ phishing attacks (usa.kaspersky.com)
- ^ quantum computing (www.scientificamerican.com)
Authors: Robin Chataut, Assistant Professor of Cybersecurity and Computer Science, Quinnipiac University
