A technical tip: how to protect your communications with encryption

LONDON — After a sprawling hacking campaign revealed the communications of an unknown number of Americans, U.S. cybersecurity officials are advising people to use encryption in their communications.

To guard against the risks highlighted by the campaign, launched in China, federal cybersecurity authorities issued a long list of security recommendations for U.S. telecommunications companies, such as Verizon and AT.&T – which were targeted. The advice includes one we can all put into practice with our phones: “Make sure traffic is end-to-end encrypted wherever possible. »

End-to-end encryption, also called E2EE, means that messages are encrypted so that only the sender and recipient can see them. If someone else intercepts the message, all they will see is a garbled message that cannot be deciphered without the key.

Law enforcement officials had until now resisted this type of encryption because it meant the tech companies themselves would not be able to view the messages or respond to law enforcement requests. aimed at disclosing the data.

Here’s a look at the different ways everyday consumers can use end-to-end encryption:

Officials said the hackers targeted the metadata of a large number of customers, including information about dates, times and recipients of calls and text messages. They also managed to see the content of texts from a much smaller number of victims.

If you are an iPhone user, information in text messages you send to someone else who also has an iPhone will be end-to-end encrypted. Just look for the blue text bubbles, which indicate that these are encrypted iMessages.

The same goes for Android users who text via Google Messages. There will be a lock next to the timestamp on each message to indicate that encryption is enabled.

But there is a weakness. When iPhone and Android users text each other, the messages are encrypted only using Rich Communication Services, an industry standard for instant messaging that replaces the older SMS and MMS standards.

Apple has note that RCS messages “are not end-to-end encrypted, meaning they are not protected from being read by a third party when sent between devices.”

Samsung, which sells Android smartphones, also alluded to the problem in a footnote. press release last month on RCS, saying: “Encryption only available for Android to Android communications.”

To avoid getting caught while texting, experts recommend using encrypted messaging apps.

Privacy advocates are big fans of Signal, which applies end-to-end encryption to all messages and voice calls. The independent, non-profit group behind the app promises to never sell, rent or lease its customers’ data and has done its best to do so. publicly available source code so that it can be audited by anyone to review it “for security and accuracy.”

Signal’s encryption protocol is so famous that it has been integrated with that of its rival. WhatsAppusers will therefore benefit from the same level of security protection as Signal, which has a much smaller user base. End-to-end encryption is also the default mode for Facebook Messengerwhich, like WhatsApp, is owned by Meta Platforms.

Telegram is an app that can be used for one-on-one conversations, group chats, and broadcast “channels,” but contrary to popular perception, it does not enable end-to-end encryption by default . option. And it doesn’t work with group chats.

Cybersecurity experts have warned people against using Telegram for private communications and stressed that only its optional “secret chat” feature is end-to-end encrypted. The app also has a reputation for being a haven for scammers and criminal activity, as founder and CEO Pavel Durov pointed out. arrest in France.

Instead of using your phone to make calls over a wireless cellular network, you can make voice calls with Signal and WhatsApp. Both apps encrypt calls with the same technology they use to encrypt messages.

There are other options. If you have an iPhone, you can use Facetime for calls, while Android owners can use the Google Fi service, both of which are end-to-end encrypted.

The only problem with all of these options is that, like using chat services to send messages, the person on the other end will also need to have the app installed.

WhatsApp and Signal users can customize their privacy preferences in settings, including hiding the IP address during calls to prevent your general location from being guessed.

___

Is there a technical topic that you think needs to be explained? Email us at onetechtip@ap.org with your suggestions for future editions of One Tech Tip.