Are Free, “Secure” Text Messaging Apps Good Enough?

Recently, I enjoyed an article in the NY Times titled, “Protecting Your Digital Life in 8 Easy Steps.” It was an excellent “How to” article for the consumer, providing simple tips on protecting digital content. Protecting our digital assets is an important conversation that does not get enough coverage and I commend the NY Times for their initiative in helping to educate people about cyber threats and basic security measures. The Time’s recommendations are helpful, but they are first steps, and even then, some are incomplete. And, as the article appears in the “Personal Tech” section, it does not address the needs of business people.

Secure Text Messaging…What about Voice?

The first recommendation is to send encrypted text messages using Signal or WhatsApp. This recommendation intrigued me, because securing text messages is just a partial step. The principal form of mobile communications is making a phone call, actually speaking with someone. Protecting voice calls is as important as securing text messages. The Times fails to make this important recommendation. Encrypting text messages and not phone calls is akin to “locking the door, but leaving the window open.”

The reality is that while Signal and WhatsApp provide encrypted messaging, and their encrypted messaging is better than native text messaging (SMS) standard on phones today. However, one of the areas in which they fall short is in encrypted voice calls. Their calling feature is lacking and phone calls are of poor quality and difficult to hear. Research indicates that if sound quality is poor people will stop using the solution, typically within a day or two.

“Free” with an Expensive Price Tag

An additional concern with these and other similar free solutions is the fact that while they are “free,” they come with a hidden, expensive price tag; the collection, aggregation, analysis (and sometimes selling) of user metadata. In other words, they compromise on privacy in ways that are less obvious, but nonetheless invasive. The reason Facebook paid $19 Billion for WhatsApp is that WhatsApp delivers tremendous value to Facebook about who is using it, where they are, with whom they are communicating, for how long and more. With enough metadata of this type, Facebook can profile WhatsApp users virtually in the same way as they could by reading the texts or listening to the calls in the first place. The user and their metadata are “the product.”

Consumer Products Fall Short for Business Users

While these free solutions may work to some extent for consumer users, where they really fall short is within businesses, large and small alike. At the end of the day, businesses require communications that are completely secure, easy to use, and provide great sound quality.

Many businesses recognize the drawbacks of free solutions including WhatsApp and Signal and do not want their employees communicating on these platforms because they do not want Facebook and other services to obtain their metadata. As valuable as the metadata is to Facebook, it can be equally as costly and dangerous to the businesses whose people use WhatsApp. At KoolSpan, we regularly receive calls from companies asking us to provide them a solution so they can get their employees to stop using WhatsApp and other similar services.

Finally, business solutions require oversight, management and control and enterprise-grade features. Business people want to be able to call someone’s desktop phone securely, not just another mobile phone. Businesses often need to manage their employees’ phones with a “Mobile Device Management” (MDM/EMM) solution. Many businesses integrate their mobile communications into other IT systems, ideally via APIs, and many businesses therefore want the option to host their own secure mobile communication system.

As with everything, it may sound nice to delineate “Easy” steps to protecting and securing your digital assets. However, while the solution should be easy to implement, choosing the right solution still requires more thinking than the NY Times leads us to believe.

Elad Yoran

Elad Yoran is Executive Chairman of KoolSpan, CEO of Security Growth Partners (SGP) and Associate Adjunct Professor at Columbia University School of International and Public Affairs (SIPA). He is a 20+ year cybersecurity executive and entrepreneur, among other things having founded and led many foundational cyber companies. He serves as director at Infinidat as well as on several government and industry boards including the Army Cyber Institute, the Cloud Security Alliance, and previously, the FBI IT Advisory Council. Elad is the author of many articles going back to the original Internet Security Threat Report research papers. Elad’s cybersecurity entrepreneurial experience, for which he was honored as “Entrepreneur of the Year” by E&Y, includes Riptech, acquired by Symantec; MediaSentry, acquired by SafeNet; Sentrigo, acquired by McAfee; Vaultive, acquired by CyberArk and others. Previously, Elad served as VP Global Business Development at Symantec. In addition, Elad was a strategic investor and director/advisor to Red Owl Analytics, acquired by Forcepoint; NetWitness, acquired by RSA; ThreatGrid, acquired by Cisco; and Insightix, acquired by McAfee. Previously, Elad served as a US Army officer and is a veteran of Operation Restore Hope in Mogadishu, Somalia. He is a graduate of the Wharton School and West Point.