What Is End-to-End Encryption? We Checked Which Apps Really Use It
End-to-end encryption means only you and the person you message can read it. We checked 10 popular apps to see which really use it by default.
Key takeaways
- End to end encryption means only the users can read the contents of the message. This also means that a service providing the messaging cannot read the contents of a message.
- We examined the ten most popular messaging applications, as well as documentation provided by the services and user reports. We discovered that five of these messaging applications natively implement end to end encryption. Two of the applications implement end to end encryption for some conversations and three do not implement end to end encryption for typical conversations.
- The biggest shock is that Telegram does not currently support end to end encryption in normal chats and group chats.
- End to end encryption helps secure the contents of a chat, but does not help secure the identity of the people in the conversation, the timing of the conversations or the security of your unlocked phone in the hands of another person.
Many messaging apps claim to be encrypted. The meaning of this term is not very useful. Most apps do implement some sort of encryption between the user and the messaging service. What is more useful though is whether the messaging service can read a message after it has been received.
What is end-to-end encryption?
Every end to end encrypted messaging system uses key pairs on each device that participates in the conversation. The public key can be given out to all and the private key is kept on the device. When talking to another user for the first time, your application will use their public key to create a shared secret between just your device and theirs. Messages are encrypted with a key generated from this shared secret. WhatsApp and Signal also generate a new key for each message so only the two devices in the conversation will be able to decrypt it.
How end-to-end encryption works
Here is how a message passes when sent.
End-to-end encryption vs encryption in transit
There is a less secure form of encryption used by a number of services known as encryption in transit. This means the message is encrypted on the user device on transit to the service provider then decrypted by the service provider then re-encrypted on transit to the end user. This stops others on the same Wi-Fi from reading the message but allows the service provider to read it whilst in transit.
Which apps are end-to-end encrypted by default?
We took ten services in use by many users and researched the support pages and user discussions to find out whether these services provide end to end encryption by default (with no user configuration required).
As anticipated end to end encryption has been provided by email and social messaging services to a limited degree whilst it has been provided to all users by privacy focussed messaging services. Indeed one service has taken away end to end encryption this year.
Is Telegram end-to-end encrypted?
End to end encryption is often assumed to be used in all Telegram conversations. This is not the case. Regular and group chats are stored on Telegram's servers and are encrypted using a decryption key held by the Telegram service. Only end to end encrypted chats (referred to as Secret Chats) are encrypted in this way. These can only be used between two people and only on the device that the Secret Chat is initiated on.
The backup gap
End to end encryption can also be bypassed in cloud backups. Messages can be end to end encrypted when sent but can be backed up to the cloud and then decrypted by the service.
What end-to-end encryption does not protect
End to end encryption allows significant security to be applied to the content within a message. Other areas however are not encrypted.
- It does not protect who you are contacting or when and how often
- It does not protect against someone unlocking your phone
- It does not protect against a screenshot by the other party
- Cloud backups are not always protected
Is email end-to-end encrypted?
Email is not an end to end encrypted service by default. Email can be encrypted between email servers but the email service on both ends may still be able to read the email. Google have implemented end to end encrypted messages in Gmail but only for certain business accounts and only if enabled by an administrator.
Is a VPN end-to-end encryption?
Using a VPN does not provide end to end encryption. All data between your device and the VPN server will be encrypted which means it is safe from your local router and from your internet service. Once the data passes through the VPN server it will be transmitted as it would have been without the VPN. A VPN and end to end encrypted services protect from different points in the communication chain.
How to check your chats are protected
End to end encrypted messaging does not need any technical knowledge. There are however some actions that users can take to help achieve end to end encryption.
-
Look for the lockSome messaging services do provide some type of symbol at the top of end to end encrypted conversations. This may be in the form of a note or a lock. If there is no such symbol then assume the conversation is not end to end encrypted.
-
Compare safety numbersFor important conversations match the security code or safety number with the other party personally. If the numbers match then there is no one in the middle.
-
Check your backupsLook at the backup options provided by your messaging service and see if your messages are end to end encrypted when backed up. If they are not then your messages could be stored in the cloud and accessed.
-
Keep your phone locked and updatedEnd to end encryption will not help if someone gains access to your phone itself. Make sure you install all updates and set a screen lock that no one but you could guess.
End-to-end encryption myths
-
Myth
If an app says encrypted, the company cannot read it.FactNot always. There are services that use encryption for a specific encryption method which can still be decrypted by the service itself. End to end encrypted messages are the only type of encryption where the service cannot read the messages.
-
Myth
Every Telegram chat is end-to-end encrypted.FactOnly Secret Chats are end to end encrypted. Regular chats and in groups are not end to end encrypted.
-
Myth
End-to-end encryption makes you anonymous.FactMessages are encrypted but sender, recipient and send time are not.
Where Senton fits
End to end encryption is very important to the next product we are creating. Up next is Senton Mail. This is a mail service that provides end to end encryption and is meant for private use. Currently Senton VPN provides encryption between the user and our server.
The bottom line
- With end to end encryption the carrier of the message cannot read the content of the message.
- 5 of the 10 services we reviewed provide end to end encryption by default. SMS, Instagram, Gmail and Telegram do not provide end to end encryption by default.
- Data backups should also consider encryption. This is often not the case.
- Message content is encrypted but data regarding users you communicate with is not encrypted.
Frequently asked questions
Yes. Personal messages and calls on WhatsApp have been end-to-end encrypted since 2016. For end-to-end encrypted message backups this needs to be enabled.
No. All group chats on Telegram are encrypted by Telegram. Only Secret Chats which need an active user choice are end-to-end encrypted.
Encryption is very secure and very difficult to crack. Messages can be leaked if the device is compromised or left unencrypted, through unencrypted backups or through sharing a message in a group chat.
Standard Gmail is not end-to-end encrypted. Some business Gmail accounts do support end-to-end encryption but this requires administrator setup.
The service cannot provide messages from its servers to law enforcement. The service does not own the encryption keys. However, a message can be viewed by the recipient of the message, an unencrypted backup or by accessing the message on an unlocked device.
No. A VPN provides encryption between the user's device and the VPN server. End-to-end encryption provides encryption all the way to the end user receiving the message.