Let’s say I have a phone and I send messages to friends, one through encrypted messaging, and one through un-(non?)encrypted messaging (do these even exist anymore?)
What makes the former more secure? How does one access the latter?
If someone has your phone password they are of equal security of course, but if they don’t then what protections does the encrypted service offer that the unencrypted one doesn’t?
In: 1
The protection the encrypted service offers that the unencrypted on doesn’t is… well… encryption.
A correctly implemented encryption service will ensure that only those with access to the phone can read the messages, not your phone company, not the people that run the app, not the person whose WiFi you’re on, not anyone else on the internet, etc.
Without encryption, you open yourself to any or all of those people being able to read the messages you’re sending.
End to end encryption means that along the path of traffic, the devices in the middle are unable to view the contents of the information packets that make up your transmission.
A security session between the devices is established, and the data is scrambled in a way that the receiving device can decode it to the original state during that session, but where intercepting it in between is meaningless.
Without end to end encryption, a device in the middle (or devices designed to listen in on wireless mediums) can literally grab a copy of the data stream, rip open the information packets, and reassemble the data inside into usable data. That could be your chat messages, but also could be your bank account information if your purchase transaction wasn’t encrypted.
We’ve reached a point technologically where the extra strain of always on encryption isn’t much of an issue, so there’s really no reason for most applications to not enforce encryption.
With encrypted messaging, you’re protected from someone grabbing the messages as they’re being sent between you and your friend. If someone were monitoring the data that was being sent through a network, they could see the contents of messages you are sending to your friend(your phone and computer encrypt nearly all data that is sent over a network, so this doesn’t happen much any more). If your messages are sitting on the chat apps server and they aren’t encrypted, someone could read them there as well. This tends to be the reason why people would prefer encrypted messaging. In this case, you would want your messages encrypted end to end, so that it’s encrypted with a key that only your friend has.
If you wanted to snoop on your friend’s unencrypted messages, you could invite them to connect to a WiFi network that you have admin access to, then use packet sniffing software to examine their traffic. If, however, you are a state intelligence agency, an unscrupulous business or an organised crime outfit, you have a lot more options in compromising any of the various services involved in transmitting that data.
Fully unencrypted messaging is pretty rare. This is where you simply send the contents of the message, and anyone who has any sort of access to the network can read it. This was the case for the original email services, 2G SMS, and is still the case for some intentionally quasi-public channels like HAM radio. Even here snooping can be hard, e.g. if you have to physically tamper with a wire carrying the signal, but this is the source of the whole “public internet routers can read your data”.
Most messaging is at the very least encrypted between you and the service provider. The service provider might be the website (e.g. Facebook, Google) or physical provider (e.g. cellular base station for SMS). Even if someone is sharing the network that you and the provider are on, they will not be able to read the messages. However, the provider can read the messages, even if you’re only intending to send it to a friend. The provider can also share this message with someone if they choose, like law enforcement.
It is now becoming popular to use messaging services encrypted between you and the recipient, or end-to-end encrypted messaging. This means that the service provider also cannot read the messages, they can only see that messages are being sent, and who is sending/receiving them. These included many popular service like Telegram, Whatsapp, Wire, Viber, but notably not Facebook Messenger (unless you enable the Secret chat mode).
There are various even stronger forms of privacy that also attempt to hide even the metadata of who the sender/receiver are, like Signal’s [sealed sender](https://signal.org/blog/sealed-sender/) system or [SimpleX chat](https://simplex.chat/), but those are not yet dominant.
There are (free and legal) tools to read what data goes to what service from which device if you are on the same network. If you use encrypted services, the data you send will be scrambled with an algorithm that needs a key to unscramble. If someone wants to see it without permission, they won’t have the key to reveal what’s in it. If it’s not encrypted, anyone can read it. On a public WiFi with potentially hundreds of devices on it, you can never know if someone is looking for unencrypted messages. Not to mention service providers, authorities or malicious software that could be between your device and the server you’re sending data to
Latest Answers