Secure Messaging? More Like A Secure Mess.
By Nate Cardozo, Gennie Gebhart, and Erica Portnoy
There is no such thing as a perfect or one-size-fits-all messaging app. For users, a messenger that is reasonable for one person could be dangerous for another. And for developers, there is no single correct way to balance security features, usability, and the countless other variables that go into making a high-quality, secure communications tool.
Over the next week, we'll be posting a series of articles to explain what makes different aspects of secure messaging so complex:
Why We Can't Give You A Recommendation
Thinking About What You Need In A Messenger
Building A Secure Messenger
Beyond Implementation: Policy Considerations for Messengers
Back in 2014, we released a Secure Messaging Scorecard that attempted to objectively evaluate messaging apps based on a number of criteria. After several years of feedback and a lengthy user study, however, we realized that the "scorecard" format dangerously oversimplified the complex question of how various messengers stack up from a security perspective. With this in mind, we archived the original scorecard, warned people to not rely on it, and went back to the drawing board.
Along with the significant valid criticisms of the original scorecard, EFF has heard supporters' requests for an updated secure messaging guide. Throughout multiple internal attempts to draft and test a consumer-facing guide, we concluded it wasn't possible for us to clearly describe the security features of many popular messaging apps, in a consistent and complete way, while considering the varied situations and security concerns of our audience.
So we have decided to take a step back and share what we have learned from this process: in sum, that secure messaging is hard to get right—and it's even harder to tell if someone else has gotten it right. Every day this week, we'll dive into all the ways we see this playing out, from the complexity of making and interpreting personal recommendations to the lack of consensus on technical and policy standards.
For users, we hope this series will help in developing an understanding of secure messaging that is deeper than a simple recommendation. This can be more frustrating and takes more time than giving a one-and-done list of tools to use or avoid, but we think it is worth it.
For developers, product managers, academics, and other professionals working on secure messaging, we hope this series will clarify EFF's current thinking on secure messaging and invite further conversation.
This series is not our final word on what matters in secure messaging. EFF will stay active in this space: we will continue reporting on security news, holding the companies behind messaging apps accountable, maintaining surveillance-self defense guides, and developing resources for trainers.
Here, we want to offer our contribution, based on months of investigation, to an ongoing conversation among users, technologists, and others who care about messaging security. We hope this conversation will continue to evolve as the secure messaging landscape changes.
Users interested in secure messaging can also check out EFF's Surveillance Self-Defense guide. The SSD provides instructions on how to download, configure, and use several messaging apps, as well as more information on how to decide on the right one for you.
Security Education
Deeplinks Blog by Bill Budington | January 2, 2021
DNS, DoH, and ODoH, Oh My: Year-in-Review 2020
Government knowledge of what sites activists have visited can put them at risk of serious injury, arrest, or even death. This makes it a vitally important priority to secure DNS. DNS over HTTPS (DoH) is a protocol that encrypts the Domain Name System (DNS) by performing lookups over the secure...
Deeplinks Blog by Daly Barnett | December 16, 2020
Doxxing: Tips To Protect Yourself Online & How to Minimize Harm
"Doxxing" is an eerie, cyber-sounding term that gets thrown around more and more these days, but what exactly does it mean? Simply put, it's when a person or other entity exposes information about you, publicly available or secret, for the purpose of causing harm. It might be information you intended...
Deeplinks Blog by Alexis Hancock, Hayley Tsukayama | December 16, 2020
Vaccine Passports: A Stamp of Inequity
A COVID vaccine has been approved and vaccinations have begun. With them have come proposals of ways to prove you have been vaccinated, based on the presumption that vaccination renders a person immune and unable to spread the virus. The latter is ...
Deeplinks Blog by Andrew Crocker | December 4, 2020
In the WeChat Case, the U.S. Government Doesn't Care If It Breaks the Internet
Today, EFF—along with the Center for Democracy & Technology and the Internet Society—filed an amicus brief in support of U.S.-based users of the Chinese app WeChat, as they fight President Trump's unconstitutional ban of the application. In its rush to eradicate WeChat from U.S. shores, we explain, the administration...
Deeplinks Blog by Bill Budington, Jon Callas | November 18, 2020
macOS Leaks Application Usage, Forces Apple to Make Hard Decisions
Last week, users of macOS noticed that attempting to open non-Apple applications while connected to the Internet resulted in long delays, if the applications opened at all. The interruptions were caused by a macOS security service attempting to reach Apple's Online Certificate Status Protocol (OCSP) server, which had become...
Deeplinks Blog by Kurt Opsahl | November 16, 2020
Elections Are Partisan Affairs. Election Security Isn't.
An Open Letter on Election SecurityVoting is the cornerstone of our democracy. And since computers are deeply involved in all segments of voting at this point, computer security is vital to the protection of this fundamental right. Everyone needs to be able to trust that the critical infrastructure systems we...
Deeplinks Blog by Karen Gullo | September 3, 2020
Cryptographer and Entrepreneur Jon Callas Joins EFF as Technology Projects Director
Some of the most important work we do at EFF is build technologies to protect users' privacy and security, and give developers tools to make the entire Internet ecosystem more safe and secure. Every day, EFF's talented and dedicated computer scientists and engineers are creating and making improvements to...
Deeplinks Blog by Hannah Zhao, Kit Walsh | August 3, 2020
EFF and ACLU Tell Federal Court that Forensic Software Source Code Must Be Disclosed
Can secret software be used to generate key evidence against a criminal defendant? In an amicus filed ten days ago with the United States District Court of the Western District of Pennsylvania, EFF and the ACLU of Pennsylvania explain that secret forensic technology is inconsistent with criminal defendants' constitutional rights...
EFF to Court: Trump Appointee's Removal of Open Technology Fund Leadership Is Unlawful
San Francisco—The Electronic Frontier Foundation (EFF) today joined a group of 17 leading U.S.-based Internet freedom organizations in telling a federal appeals court that Trump administration appointee Michael Pack has no legal authority to purge leadership at the Open Technology Fund (OTF), a private, independent nonprofit that helps hundreds...
Deeplinks Blog by Karen Gullo | July 21, 2020
EFF Welcomes Cybersecurity Expert Tarah Wheeler to Advisory Board
Cybersecurity policy expert. Security researcher. Women in tech advocate. Entrepreneur. Tarah Wheeler's expertise and experience encompasses the most pressing issues in tech, and we're honored to announce that she is joining EFF's advisory board. She will be helping us with our work on information security, data privacy, building diverse...