Every-once-and-a-while, it seems wise to revisit the fast-and-ever-changing challenge of maintaining secure communication with those who serve in dark places. And in today’s world, we have several. In previous Brigada items, we’ve plussed Signal https://brigada.org/2019/02/10_25757 but we admit that some say it’s not as intuitive as other options. Are we correct that it’s available as donation-ware though? So you get to decide the price? https://signal.org/ Available on iOS, Android, Mac, Windows and Linux. What’s your fave option to Signal?
VPNs help protect all your online use – including browsing. Justin Long recently promoted Tunnelbear https://futurism.com/tunnelbear-easy-to-use-vpn but you might prefer something else. What’s your preferred secure messaging app and why? If you answer Telegram, WhatsApp or Facebook, please be prepared for a reality check. Those three have all come under fire recently for possible compromised confidence because of management decisions.
For VPN, I use PureVPN and have done so for several years. iPhone app works well and Chrome plug-in. Attractive price deals from time to time on one, three and five year terms.
There is no such thing as “secure” communication, certainly not with a single product. Several considerations:
1) Any system can be penetrated by an opponent with enough resources and will to use those resources.
2) There is a difference between security and privacy — while there’s a lot of overlap, the two aren’t the same. Security is in keeping unwanted people out, privacy is in what the people who have access to data can (or might) do with that access.
3) There is also question of what you get (or not) with “free” services. Although there are some services that may have unpaid tiers of access, usually with various limitations of capacities, and where those unpaid tiers are essentially “promoware” to encourage upgrades to paid tiers, with services that have no paid offerings, they’re generally ad-supported. In that construct, if you’re not paying, you’re not the customer, you’re the product being sold. And for that, providers generally absolve themselves (via EULA contracts) of most responsibilities to users.
4) There is difference between “data in motion” (i.e., in-transit) and “data at rest” (in storage). It’s fairly easy (and with Google’s efforts over the last 3 or 4 years, very common) to protect data in motion, usually via SSL encryption. SSL is relatively easy to implement, and difficult to penetrate. However, encryption of storage is comparatively rare. There are some storage services that support “zero knowledge” where content is stored encrypted and where providers don’t have encryption keys, but for most communication (especially email) content is generally exposed to intermediaries.
5) Metadata is data about data, and often may reveal more than the raw data itself. For something as simple as a word processing file, the metadata is what you can find out about a file’s properties (in Windows, right-click on any file, and select Properties). For communications, that can show a lot of information about communication (including what can be tracked from a server) that often includes dates and times, frequency and size of communications, identities of senders and receivers, what platform (and software) the sender is using, and more, even if message content is encrypted.
6) VPN is frequently mis-understood, and many VPN users are using for the wrong reason, often not getting much real benefit for the costs incurred (including money and performance overhead). Ultimately, a VPN is an encrypted tunnel between the user and the provider. For that, the provider has access to all data that passes through the VPN that isn’t otherwise encrypted, and once outbound data leaves the VPN, it’s not encrypted. A VPN *can not* provide end-to-end encryption. There are multiple uses of a VPN, and different providers often specialize in different uses:
– Direct connection to a specific server (especially corporate use)
– Cloaking user activity, where it can’t be observed by a local ISP (most frequent missions use)
– Hiding user’s location on the Internet (and physical location). Useful for activists that need to protect identities and locations in public use
– Shifting of apparent location — good for working around geographic restrictions, such as media that may not be available outside of certain countries.
On the second point, cloaking isn’t necessarily as useful as many tend to assume. As noted, thanks to Google’s efforts, SSL connectivity is very widely used (although not universal, at least not yet), and if you’re connecting to a web page that uses https or sending mail through a server that supports SSL connections, the encryption provided by the VPN doesn’t add security to a connection that’s already encrypted, even if the VPN will hide the the identity of the server being connected to. And as noted, the VPN provider has access to all that data. Thus, if using a VPN, it’s essential to use a trustworthy provider (normally paid). Don’t bother with a “free” provider, as they’re likely doing that as a way of getting at your data and metadata, for their own purposes.
A VPN also won’t necessarily protect all your connections. I don’t know if it’s possible to force all connections to go through a VPN or not, but some applications may avoid using a VPN, especially if they use their own VPN. I know that in the original design of Skype, it was intended to be agile, where it would shift connections on the fly, whenever it would detect that such a shift would provide better performance. Since a VPN adds a performance lag, the original design of Skype would generally cause it to route connections away from an available VPN, because non-VPN would be faster. I don’t know if that’s still the case with Skype under Microsoft ownership (and where there have been a lot of architectural changes), but I encourage people to assume that a VPN will not protect Skype traffic.
As for the question of Instant Messaging tools and alternatives, right now there’s lots of attention being paid to announced changes in WhatsApp, but in some ways, those changes may be over-stated. WhatsApp still does end-to-end encryption, where content is encrypted, and WhatsApp can’t see that. On the other hand, WhatsApp can see metadata, and if you don’t opt out, WhatsApp has access to all your contacts (and opting out does make WhatsApp more difficult to use). All of that is in WhatsApp’s core architecture that was there before acquisition by Facebook. What will be changing is that Facebook will be selling more of that data to business users, typically advertisers, as a way of delivering more ads targeted by user activities. For what it’s worth, this is why Facebook is so upset with Apple’s announced intentions of requiring iPhone users to opt in to non-anonymized tracking, because it disrupts Facebook’s abilities to generate revenue from that kind of tracking.
Use of VPN probably doesn’t offer any increase of protection for users of WhatsApp and similar services. The encryption is already end-to-end between sender and recipient, and WhatsApp is already inside the connection, where they can continue to track metadata.
As for Signal, there are things to like about it, but altruism can only go so far. As a service, they have to have revenue to keep the service operating. I’m not aware of their financial model, and where their primary revenue stream is. Yes, they accept donations, but microscopically few will actually contribute, and I think there may come a time in the future where they have to find new revenue streams to keep going. Most of the time, the decision is in whether they move to a paid service, and charge users, or they continue to offer use for no charge to the user, but sell access to the metadata to advertisers.
VERY helpful, Zed! Super. Thanks for the time you took!