Who Reads Your Messages Without You Knowing?

We all send messages, a lot of us call them texts even though we might not be actually sending them via SMS. Not only do some of us send a lot of messages we now rely on them instead of phone calls, which might also not really be phone calls but you know what I mean.

SMS ("text") - least secure

The one we all started with, that we fall back to when nothing else works, the basic, the granddaddy of all messages. SMS / text is the one we know will get through when other fancy messaging systems may not, it covers the world.

It's also totally insecure. Your message is sent unencrypted. You message carries all it's metadata (who from, who to, date & time sent, where sent from) is unencrypted.

Think of text as sending a postcard in the post. Yes, it will get there but anyone and everyone can read it on the way, including it's address, stamp, and who from.

If you have set-up 2FA / multi-factor authentication - you absolutely should for your Google, Apple, Facebook, Microsoft accounts, and everything you use - using SMS as the way to receive your one-off codes is NOT the best move. Use an authentication app which uses maths and time to create the one-off codes, it's the only way to go.

SMS doesn't do video calling but, using MMS, it can send images ... these are all on a postcard for all to read.

DM / PM via social media apps - almost secure

DM (Direct Message) and PM (Personal Message) aren't really messaging services but we do use them sometimes, in Instagram's use is almost mostly messaging and not sharing photos.

The security of these 'add-on' messaging system is totally down to the system you use, which is often not really what they're up for. Mastodon for instance allows 'private' posts but it's not encrypted and not something I'd ever recommend, same for BlueSky. I would place these types of messaging 'apps' as close to unencrypted, and somewhere close to RCS / iMessage.

NOTE: from now on I talk about "message" but this includes written messages, images/videos/attachments, and voice and video calling. If I say a message is encrypted I also mean your sent photo is encrypted, or your video call is encrypted.

RCS & iMessage - base security

iMessage for those that use Apple hardware is likely to be the way you send your messages. Between other Apple hardware users this will be encrypted as it leaves your iPhone, flows through Apple servers, to other Apple devices (end-to-end encryption). Messages are also encrypted on the Apple devices the message is delivered to.

BUT, Is Apple iMessage End-to-End Encrypted? It Depends:

... if you’re not using Advanced Data Protection, and you have iCloud Backup enabled on any device where you use iMessage, the key to decrypt your messages is included in the backup stored on Apple’s servers. Apple can read your backup; 

All of this encryption only applies to the message itself but NOT it's metadata (who from, who to, date & time sent, where sent from) which is all unencrypted. So Apple (and whoever demands access) may not know what you said but they can find out who you said it to, when, and from where.

Of course iMessage only works between other iMessage users and will drop down to text (see above) when chatting with non-iMessage people, which is the vast majority of the people in the world.

What Apple should support is RCS (Rich Communication Services) which would mean security would be retained. RCS is Google's answer to iMessage and all the other message apps out there. It's an open standard, like SMS, and so any telecom provider can use it ... whether yours does is for you to find out, but if not you can use Google's servers instead. 

The story is the same as Apple's iMessage, between other RCS users (Android devices tbf) this will be encrypted as it leaves your device, flows through Google servers, to other RCS users (end-to-end encryption). Messages are also encrypted on the Android devices the message is delivered to.

Again, encryption only applies to the message itself NOT it's metadata (who from, who to, date & time sent, where sent from) which is unencrypted. AND, RCS will drop back to text if it has to in order to send the message.

The only way any of this can get better is for Apple to support RCS in iMessage and then it won't drop down to the totally unencrypted SMS - Apple say they have, yay, and it seems to be coming but reluctantly and with a lot of hrumphing and NOT in NZ yet.

Facebook Messenger & WhatsApp - widely used base security

Let's talk the big ones, both owned by Meta.

Messenger was built by Meta and WhatsApp was bought. Both act similar to iMessage / RCS as above but are tied to 'that' social media company.

As for encryption both apps have rolled out end-to-end-encryption, so your message from you, via the Internet and Meta servers, on to the recipient(s) is encrypted. No, of course the metadata is NOT encrypted so Meta, and anyone that demands of them, can see who from, who to, date & time sent, where sent from, and the journey your message has taken.

Signal - full security

The absolute gold standard of encryption for messaging, Signal.

Interestingly you are very likely using Signal technologies even if you're not using the app as the Signal Protocol is the encryption tech, underneath RCS, Messenger, WhatsApp, and many other end-to-end encryption messaging services.

Message content is encrypted from you, via the transient Signal servers, to your recipients, this is almost standard for all the above and means the content can't be snatched and read.

Signal ALSO encrypts all the metadata, so who sent it (you), the recipients, when, how to go there, what profile information you may have, what groups it was sent in ... all that extra bumf is encrypted and never stored by Signal.

When Signal receives a subpoena it's an easy response from them, "We don't have anything to give you, sorry."

... say law enforcement goes to the headquarters of a company that produces pens. They bring a specific pen to the company, and they ask the company to tell them everything that’s ever been written with that specific pen. Of course the company would look at them like WTF. That’s not how pens work, we can’t tell you that! Everyone would get that, understand it, and let law enforcement go on their way.

[source: Why I, And You Should, Use Signal Messaging App and Back into the Trenches of the Crypto Wars]

----

More information:

• EFF: Communicating With Others
• EFF: Why Communication Metadata Matters

To conclude, FBI document shows what data can be obtained from encrypted