Comparison of Messaging Apps from a Security/Privacy POV

Charts

Explore

Messaging Apps from a Privacy Perspective

View App:

Allo

+12

⁠

Messaging Apps

Messaging Apps

Name

Score

Company jurisdiction

Infrastructure jurisdiction

Divulged Data

Built-In Spyware

Transparency Report

General Stance

Funding

Company Collects Data

App Collects Data

Default Encryption?

Cryptographic primitives

Client Open Source?

Server Open Source?

Anonymous Signup

Anonymous Contact Adding (without Server)

Can you manually verify contact's fingerprints?

Directory service, could be modified to enable a MITM attack?

Do you get notified if a contact's fingerprint changes?

Is personal information (mobile number, contact list, etc.) hashed?

generate & keep a pkey on the device itself?

Can messages be read by the company?

Does the app enforce perfect forward secrecy?

Does the app encrypt metadata?

Does the app use TLS/Noise

Does the app use certificate pinning?

Does the app encrypt data on the device? (iOS and Android only)

Does the app allow a secondary factor of authentication?

Are messages encrypted when backed up to the cloud?

Does the company log timestamps/IP addresses?

Have there been a recent code audit and an independent security analysis?

Is the design well documented?

Does the app have self-destructing messages?

Name

Score

Company jurisdiction

Infrastructure jurisdiction

Divulged Data

Built-In Spyware

Transparency Report

General Stance

Funding

Company Collects Data

App Collects Data

Default Encryption?

Cryptographic primitives

Client Open Source?

Server Open Source?

Anonymous Signup

Anonymous Contact Adding (without Server)

Can you manually verify contact's fingerprints?

Directory service, could be modified to enable a MITM attack?

Do you get notified if a contact's fingerprint changes?

Is personal information (mobile number, contact list, etc.) hashed?

generate & keep a pkey on the device itself?

Can messages be read by the company?

Does the app enforce perfect forward secrecy?

Does the app encrypt metadata?

Does the app use TLS/Noise

Does the app use certificate pinning?

Does the app encrypt data on the device? (iOS and Android only)

Does the app allow a secondary factor of authentication?

Are messages encrypted when backed up to the cloud?

Does the company log timestamps/IP addresses?

Have there been a recent code audit and an independent security analysis?

Is the design well documented?

Does the app have self-destructing messages?

Allo

USA

Belgium

Finland

Ireland

the Netherlands

Chile

Taiwan

Singapore

✖️ Yes

✔️ No

✔️ Yes

✖️ Poor

Google

✖️ Yes

✖️ No

✖️ Yes

✖️ No

✖️ Yes

❓ Unknown

✔️ Yes

❓ Unknown

✖️ No

❓ Unknown

✔️ Yes

✖️ No

✔️ Yes

iMessage

-7

USA

Ireland

Denmark

Google Cloud

✖️ Yes

✔️ No

✔️ Yes

✖️ Poor

Apple

✖️ Yes

✔️ Yes

ECDSA 256

AES 128

SHA-1

RSA 1280

✖️ No

✖️ Yes

✖️ No

✔️ Yes

✔️ No

✖️ No

✔️ Yes

✖️ No

✔️ Yes

❓ Somewhat

✖️ No

Messenger

-10

USA

Sweden

Ireland

✖️ Yes

✔️ No

✔️ Yes

✖️ Poor

Facebook

✖️ Yes

✖️ No

Curve25519

AES 256

HMAC-SHA256

✖️ No

✔️ Yes

✖️ Yes

✖️ No

✔️ Yes

✖️ Yes

✔️ Yes

✖️ No

✔️ Yes

❓ Unknown

✖️ No

❓ Unknown

✔️ Yes

❓ Somewhat

✔️ Yes

Riot/Matrix

12.5

✔️ No

✖️ No

✔️ Good

New Vector Limited

✔️ No

✔️ Minimal

✖️ No

Curve25519

AES 256

HMAC-SHA256

✔️ Yes

✖️ No

✔️ Yes

✖️ Yes

✔️ Yes

✔️ No

✔️ Yes

❓ Unknown

✔️ Yes

❓ Unknown

✔️ Yes

✖️ No

❓ Unknown

❓ Somewhat

✖️ No

Signal

8.55

USA

✔️ No

✔️ Yes

✔️ Good

Freedom of the Press Foundation

the Knight Foundation

the Shuttleworth Foundation

Open Technology Fund

Signal Foundation (Brian Acton)

✔️ No

✔️ Minimal

✔️ Yes

Curve25519

AES 256

HMAC-SHA256

✔️ Yes

✖️ No

✔️ Yes

✖️ Yes

✔️ Yes

✔️ Mostly

✔️ Yes

✔️ No

✔️ Yes

✖️ No

9/30/2014

❓ Somewhat

✔️ Yes

Skype

-12.5

USA

the Netherlands

Australia

Brazil

China

Ireland

Hong Kong

Japan

✖️ Yes

✔️ Yes

✖️ Poor

Microsoft

✖️ Yes

✔️ Yes

AES 256

SHA-1

RSA-1536

RSA 2048

✖️ No

✖️ Yes

✖️ No

✖️ Yes

❓ Unknown

✔️ Yes

❓ Unknown

✖️ No

❓ Unknown

✔️ Yes

✖️ No

-11

USA

Belize

Singapore

USA

Finland

✔️ No

✖️ No

✖️ Poor

Pavel Durov

✖️ Yes

✖️ No

RSA 2048

AES 256

SHA-256

✔️ Yes

✖️ No

✖️ Yes

✖️ No

✔️ Yes

✖️ Yes

✖️ No

❓ Unknown

✔️ Yes

❓ Unknown

✔️ Yes

10/31/2015

❓ Somewhat

✔️ Yes

Threema

Switzerland

✔️ No

✔️ Yes

✔️ Good

Crowdfunding

✔️ No

✔️ Yes

Curve25519 256

XSalsa20 256

Poly1305-AES 128

✖️ No

✔️ Yes

✖️ Yes

✔️ Yes

✔️ No

✖️ No

✔️ Yes

✖️ No

10/31/2015

❓ Somewhat

✖️ No

Viber

Japan

Luxembourg

USA

✔️ No

✖️ No

✖️ Poor

Rakuten

friends and family of Talmon Marco

✖️ Yes

✔️ Yes

Curve25519 256

Salsa20 128

HMAC-SHA256

✖️ No

✔️ Yes

✖️ Yes

✔️ Yes

✖️ No

✔️ Yes

✔️ No

✔️ Yes

❓ Unknown

✔️ Yes

❓ Unknown

✖️ No

❓ Unknown

✔️ Yes

❓ Somewhat

✖️ No

-9

USA

✖️ Yes

✔️ No

✔️ Yes

✖️ Poor

Facebook

✖️ Yes

✔️ Yes

Curve25519

AES 256

HMAC-SHA256

✖️ No

✔️ Yes

✖️ Yes

✖️ No

✔️ Yes

✔️ No

✔️ Yes

✖️ No

✔️ Yes

❓ Unknown

✔️ Yes

❓ Somewhat

✖️ No

Wickr

USA

✔️ No

✔️ Yes

✔️ Good

Gilman Louie

Juniper Networks

the Knight Foundation

Breyer Capital

CME Group

Wargaming

✔️ No

✔️ Yes

ECDH512

AES 256

HMAC-SHA256

✖️ No

✔️ Yes

✖️ No

✔️ Yes

✖️ Yes

✖️ No

✔️ Yes

✔️ No

✔️ Yes

❓ Unknown

✔️ Yes

❓ Unknown

✖️ No

7/31/2014

❓ Somewhat

✔️ Yes

Wire

16.6

Switzerland

Germany

Ireland

✔️ No

✔️ Yes

✔️ Good

Janus Friis

Iconical

Zeta Holdings Luxembourg

✔️ No

✔️ Minimal

✔️ Yes

Curve25519

ChaCha20

HMAC-SHA256

✔️ Yes

✖️ No

✔️ Yes

✖️ Yes

✔️ Yes

✔️ Mostly

✔️ Yes

✔️ No

✔️ Yes

✔️ Mostly

✔️ Yes

✖️ No

✔️ Yes

2/28/2018

❓ Somewhat

✔️ Yes

There are no rows in this table

⁠

Top 3:

⁠

⁠@Wire ⁠ ⁠ ⁠@Threema ⁠ ⁠ ⁠@Riot/Matrix ⁠ ⁠

⁠

Bottom 3:

⁠

⁠@Skype ⁠ ⁠ ⁠@Telegram ⁠ ⁠ ⁠@Messenger ⁠ ⁠

⁠

Some Notes:

⁠

@Signal⁠

is open source nominally, but the only version that people can use is a binary, available on the app store and on a page on signal's website. There's no way of knowing the binary is the same version as the one who's source we have access to, or wasn't tampered with (maliciously, or due to simple negligence). There is also no way to host the server in a way that communicates with the main signal server, so for all practical purposes, Signal is closed source.

⁠

@Telegram⁠

says they'll open the server, but they still, a few years later, have not. Telegram also gets a low rating above due to the fact that it doesn't do encryption by default, though it does have the option of secret chats.

The ranking is arbitrary. You can look below to see the score attributed to different vectors. For example, I attribute -5 to Facebook or Google, others might not think they're that evil.

⁠

@Whatsapp⁠

says they encrypt data, which is probably true as of now, but bear in mind that

Whatsapp's founder left Facebook⁠

over a feud about user privacy. Bear also in mind that Facebook routinely commits enormous fraudulent breaches of user privacy (they get fined for it, some insignificant millions of dollars every few months).

⁠

@Whatsapp⁠

stores by default backups on Google's servers. Said backups are not encrypted and are as such readily available for Google to plunder. Even if you turn backups off, it's useless if your correspondent hasn't turned them off too.

⁠

Funding

Funding

Funding

Score

Google

-5

Apple

Facebook

-5

New Vector Limited

Freedom of the Press Foundation

the Knight Foundation

the Shuttleworth Foundation

Open Technology Fund

Signal Foundation (Brian Acton)

Microsoft

-1

Pavel Durov

Crowdfunding

Rakuten

friends and family of Talmon Marco

Gilman Louie

Juniper Networks

Breyer Capital

CME Group

Wargaming

Janus Friis

Iconical

Zeta Holdings Luxembourg

There are no rows in this table

⁠

General Stance

General Stance

Stance

Score

✖️ Poor

-1

✔️ Good

There are no rows in this table

⁠

Positive Answer Preferred

Positive Answer Preferred

Answer

Score

✖️ No

-1

✖️ Minimal

-0.5

❓ Somewhat

❓ Unknown

✔️ Mostly

0.05

✔️ Yes

There are no rows in this table

⁠

Negative Answer Preferred

Negative Answer Preferred

Answer

Score

✔️ No

✔️ Minimal

0.5

❓ Somewhat

❓ Unknown

✖️ Mostly

-0.5

✖️ Yes

-1

There are no rows in this table

⁠

Juridictions

Juridictions

Juridictions

Score

USA

-2

Belgium

Finland

Ireland

the Netherlands

Chile

Taiwan

Singapore

AWS

-1

Google Cloud

-1

Denmark

Sweden

Australia

Brazil

China

Hong Kong

-1

Japan

Germany

Belize

Switzerland

Luxembourg

There are no rows in this table

⁠

Encryption Algorithms

Encryption Algorithms

Algo

Score

AES 128

AES 256

ChaCha20

Curve25519

Curve25519 256

ECDH512

ECDSA 256

HMAC-SHA256

Poly1305-AES 128

RSA 1280

RSA 2048

RSA-1536

Salsa20 128

SHA-1

SHA-256

XSalsa20 256

There are no rows in this table

⁠

source:

https://www.securemessagingapps.com⁠

⁠

Want to print your doc?
This is not the way.

Try clicking the ⋯ next to your doc name or using a keyboard shortcut (

CtrlP

) instead.