| Google Messages | Apple iMessage | Facebook Messenger | Element / Riot | Signal | Microsoft Skype | Telegram | Threema | Viber | Facebook Whatsapp | Amazon Wickr Me | Wire | Session | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Overview | |||||||||||||
| Is the app recommended to secure my messages and attachments? | No | No | No | No | Yes | No | No | Yes | No | No | No | Yes | Yes |
| Main reasons why the app isn't recommended Improvements to apps that are recommended | Named as NSA partner in Snowden revelations Makes money from personal data Data not protected, not all data protected No independent & recent code audit and security analysis Closed source | Named as NSA partner in Snowden revelations Data not protected, not all data protected No independent & recent code audit and security analysis Closed source | Named as NSA partner in Snowden revelations Encryption not enabled by default Makes money from personal data Data not protected, not all data protected No independent & recent code audit and security analysis Closed source | No independent & recent code audit and security analysis | Remove the mandatory requirement for users to sign up with a mobile number Provide more comprehensive independent assessments of security/privacy | Named as NSA partner in Snowden revelations Encryption not enabled by default Makes money from personal data Data not protected, not all data protected Closed source | Bespoke cryptography Encryption not enabled by default Data not protected, not all data protected | Make APIs and server code open source Provide more comprehensive independent assessments of security/privacy | Data not protected, not all data protected No independent & recent code audit and security analysis Closed source | Named as NSA partner in Snowden revelations Messages can be read by Facebook if marked as "abusive" Makes money from personal data Data not protected, not all data protected No independent & recent code audit and security analysis Closed source | Former NSA chief Keith Alexander is on Amazon’s board of directors Funded by the CIA Recent security audits are not public Closed source | Further limit metadata storage and logging Provide more comprehensive independent assessments of security/privacy | Implement perfect forward secrecy at the end-to-end encryption layer Provide more comprehensive independent assessments of security/privacy |
Details | |||||||||||||
| Company jurisdiction | USA | USA | USA | UK | USA | USA | USA / UK / Belize / UAE | Switzerland | Luxembourg / Japan | USA | USA | USA / Switzerland | Australia |
| Infrastructure jurisdiction | Worldwide (rollout on-going, unsure of exact locations, most likely Google Cloud regions) | USA (Ireland and Denmark planned); iMessage runs on AWS and Google Cloud | USA, Sweden (Ireland planned) | UK (and potentially all jurisdictions, given it's a decentralised messaging platform) | USA | USA, the Netherlands, Australia, Brazil, China, Ireland, Hong Kong, and Japan | UK, Singapore, USA, and Finland | Switzerland | USA | USA (unsure of other locations) | USA (unsure of other locations) | EU | Messages: Worldwide (uses de-centralised servers) Attachments: Centralised server in Canada |
| Implicated in giving customers' data to intelligence agencies? | Yes | Yes | Yes | No | No | Yes | No | No | No | Yes | No | No | No |
| Surveillance capability built into the app? | No | No | No | No | No | Yes | No | No | No | No | No | No | No |
| Does the company provide a transparency report? | Yes | Yes | Yes | No | Yes | Yes | No | Yes | No | Yes | Yes | Yes | Yes |
| Company's general stance on customers' privacy | Poor | Poor | Poor | Good | Good | Poor | Poor | Good | Poor | Poor | Poor | Good | Good |
| Funding | Apple | New Vector Limited | Freedom of the Press Foundation / the Knight Foundation / the Shuttleworth Foundation / the Open Technology Fund / Signal Foundation (Brian Acton) | Microsoft | Pavel Durov | User pays / Afinum Management AG | Rakuten / friends and family of Talmon Marco (it's very unclear) | Amazon / CIA | Janus Friis / Iconical / Zeta Holdings Luxembourg / Morpheus Ventures | LAG Foundation Ltd | |||
| Company collects customers' data? | Yes | Yes | Yes | No | No | Yes | Yes | No | Yes | Yes | Yes | No | No |
| App collects customers' data? | Yes (Difficult to assess given the app is integrated into Google's greater ecosystem) | Yes (Difficult to assess given the app is integrated into Apple's greater ecosystem) | Health & fitness / purchases / financial info / location / contact info / contacts / user content / search history / browsing history / identifiers / usage data / sensitive info / diagnostics / other data | Contact info / contacts / identifiers / diagnostics / user content (Contact info not sent when using anonymously) | Contact Info | Yes (Information not submitted to Apple Store) | Contact info / contacts / identifiers | Contact info / identifiers / diagnostics (Contact info not sent when using anonymously) | Location / identifiers / purchases / location / contact info / contacts / identifiers / usage data / user content / usage data / diagnostics | Purchases / financial info / location / contact info / contacts / user content / identifiers / usage data / diagnostics | Contact info / usage data / diagnostics (Contact info not sent when using anonymously) | Contact info / identifiers / usage data / diagnostics | No |
| User data and/or metadata sent to parent company and/or third parties? | Yes | Yes | Yes | No (User data is sent to a third party if a payment is made) | Minimal (mandatory mobile number sent to third party for registration & recovery) | Yes | Yes | No (optional mobile number sent to third party for registration) | Yes | Yes | No (optional mobile number sent to third party for registration) | Yes | No |
| Is encryption turned on by default? | Yes | Yes | No | Yes | Yes | No | No | Yes | Yes (if device supports it) | Yes (if device supports it) | Yes | Yes | Yes |
| Cryptographic primitives | Curve25519 / AES-256 / HMAC-SHA256 | RSA-1280 (encryption), ECDSA 256 (signing) / AES 128 / SHA-1 | Curve25519 / AES-256 / HMAC-SHA256 | Curve25519 / AES-256 / HMAC-SHA256 | Curve25519 / AES-256 / HMAC-SHA256 | RSA-1536 & 2048 / AES 256 / SHA-1 | RSA 2048 / AES 256 / SHA-256 | Curve25519 256 / XSalsa20 256 / Poly1305-AES 128 | Curve25519 256 / Salsa20 128 / HMAC-SHA256 | Curve25519 / AES-256 / HMAC-SHA256 | ECDH512 / AES-256 / HMAC-SHA256 | Curve25519 / ChaCha20 / HMAC-SHA256 | X25519 / XSalsa20 256 / Poly1305 |
| Are the app and server completely open source? | No | No | No | Yes (clients Element / Riot, server/API matrix.org) | Yes | No | No (clients and API only) | No (apps only) | No | No | No | Yes | Yes |
| Are reproducible builds used to verify apps against source code? | No | No | No | No | Android only | No | iOS and Android | Android only | No | No | No | No | No |
| Can you sign up to the app anonymously? | No | No | No | Yes | No | No | No | Yes | No | No | Yes | No | Yes |
| Can you add a contact without needing to trust a directory server? | N/A, Google Messages uses RCS, which doesn't use a directory service | No | No | No | No | No | No | Yes | Yes | No | No | No | Yes |
| Can you manually verify contacts' fingerprints? | Yes | No | Yes | Yes | Yes | No | No (session only, does not provide users' fingerprint information) | Yes | Yes | Yes | Yes | Yes | Yes |
| Directory service could be modified to enable a MITM attack? | N/A, Google Messages uses RCS, which doesn't use a directory service | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Do you get notified if a contact's fingerprint changes? | No | Yes | Yes | No | No (session only, does not provide users' fingerprint information) | Yes | Yes | No (setting turned off by default) | Yes | If contact was previously verified | N/A | ||
| Is personal information (mobile number, contact list, etc.) hashed? | N/A, Google Messages uses RCS, which doesn't use a directory service | No | No | Yes | Mostly | No | No | Yes | No | No | Yes | Mostly | N/A |
| Does the app generate & keep a private key on the device itself? | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | |
| Can messages be read by the company? | No | No | Yes | No | No | Yes | Yes | No | No | Yes | No | No | No |
| Does the app enforce perfect forward secrecy? | Yes | No | Yes | Yes | Yes | No (session keys do change after being used 100 times) | Yes | Yes | Yes | Yes | Yes | No | |
| Does the app encrypt metadata? | No | No | No | Yes | No | Yes | No | Yes | Mostly | Yes | |||
| Does the app use TLS/Noise to encrypt network traffic? | Yes | Yes | Yes | Yes | Yes | Yes | No | Yes | Yes | Yes | Yes | Yes | Yes |
| Does the app use certificate pinning? | Yes (>=iOS 9.3) | Yes | Yes | Yes | Yes | Yes | |||||||
| Does the app encrypt data on the device? (iOS and Android only) | No | Yes (if passphrase enabled) | Yes | Yes (if passphrase enabled) | iOS: Yes (if passphrase enabled); Android: Yes (if master key set in the app) | iOS: Yes (if passphrase enabled); Android: Yes (unsure of function) | Yes | Yes | |||||
| Does the app allow a secondary factor of authentication? | No | No | No | No | Yes | No | Yes | Yes | No | Yes | Yes (password for account used) | Yes | Yes |
| Are messages encrypted when backed up to the cloud? | Yes (>= Android P) | No | Yes | N/A, Signal is excluded from iCloud/iTunes & Android backups | Yes | iOS: Yes Android: Yes | N/A, Wickr is excluded from iCloud/iTunes & Android backups | N/A, Wire is excluded from iCloud/iTunes & Android backups | N/A, Session is excluded from iCloud/iTunes & Android backups | ||||
| Does the company log timestamps/IP addresses? | Yes | Yes | No | Yes | Yes | No | Yes | Yes | No | Some | No | ||
| Have there been a recent code audit and an independent security analysis? | No | No | No | No (Matrix's encryption library reviewed by an independent party) | Yes (October, 2014) | No | Yes (November, 2015) | Yes (October, 2020) | No | No | Yes (August, 2014) | Yes (March, 2018) | Yes (April, 2021) |
| Is the design well documented? | No | Somewhat | Somewhat | Somewhat | Somewhat | No | Somewhat | Somewhat | Somewhat | Somewhat | Somewhat | Somewhat | Somewhat |
| Does the app have self-destructing messages? | No | No | Yes | No | Yes | No | Yes | No | Yes | Yes | Yes | Yes | Yes |
Red = Something of major concern.
Yellow = Something of concern.
Green = Nothing of concern.
Blank = I couldn’t find any information about it.
N/A = Not applicable.