Which Messenger Should You Use?

A dive into encrypted messaging apps you may find useful

TL;DR

Session is the most privacy focused

Signal is the best middle ground

WhatsApp has the most users

A brief history lesson

SMS as a main method of text communication is basically dead in 2023, it’s safe to say. With more and more people, globally using WhatsApp, iMessage, telegram, FB messenger etc. SMS usage is on the downtrend. In enter the messaging apps. They’ve been around for decades, the earliest I remember using was AIM and BBM. Both of which have since fallen out of favor. And plenty have since come and gone as well.

The biggest ones left standing are WhatsApp, fb Messenger, Telegram and Signal. But in this post I’ll only be speaking on 3 of them: WhatsApp, Signal and Session. These three come with end to end encryption by default, which is why I excluded Telegram, but telegram comes with a feature called “secret chats” that offers that exact functionality. But not including it by default is troubling, it’s group chats make it extremely popular.

1. WhatsApp

WhatsApp is an end to end encrypted messaging app owned by Facebook(Meta), it didn’t always start that way though. WhatsApp, long ago, was created and maintained by Brian Acton and Jan Acoum in 2009 then sold to Facebook in 2014. It exploded in popularity in Latin America due to phone plans charging for SMS messages but provided really good data plans. I remember using it in like 2012, and still using it to this day. Brian is actually working for the Signal foundation now so he’s been directly involved in 2/3 of the apps we will cover today.

Part of WhatsApp’s code is open source so it can, and has, been through security audits. Open source is something we can cover in a later post. It’s important to note that in 2016, WhatsApp implemented signals encryption protocol which bolstered security. In later posts I will do a deeper dive into the security implications of using Signal, WhatsApp et al. This post is meant to be a high level overview for those curious about these apps.

WhatsApp is end-to-end encrypted which means that no parts of the message can be read by WhatsApp or anyone other than the sender and receiver. The only time the messages can be read is of you back up your WhatsApp, it backs up to google drive in plaintext. What this means is creating back ups of your conversation will basically undo all the encryption you’ve done throughout the life of all the backups since, apart from username and password, google drive does not allow backups. Despite this, there is still a way to remain relatively secure on WhatsApp:

• Enable disappearing messages.
• Set up 2FA to access the data.
• Ensure you are speaking with a verified user.
• Limit sensitive data sharing over WhatsApp if you feel like it is not safe. (This is good info for any platform online)

There are more, arguably more extreme measures you could take, like burner numbers etc. but for now focus on the above.

Aside from encrypted messaging, WhatsApp also has encrypted video and voice calls. Its biggest positive over Signal and Session is its network effect. WhatsApp has about 2Billion users globally, meaning odds are, someone in your immediate circle will be using it.

Caution: Listed in the photo below is all of the data that WhatsApp may be collecting from you.

Please keep this in mind when deciding on which one to both use and recommend. Always make people aware of the downsides. If you and whoever you’re recommending it to is ok with the risks, then have at it. The user interface is great, it’s smooth to use, easy to set up etc. but it is definitely NOT the most private of the three.

2. Signal

By far my favorite privacy tool, is Signal. It’s almost always at the top of any list when it comes to privacy and security focused messengers. Signal, unlike WhatsApp, is not owned by a glorified ad agency. It’s owned and maintained by the Signal Foundation, a non profit organization who’s fully funded by donations and grants. They aren’t beholden to shareholders like WhatsApp. It’s fully Free and Open Source which means it can constantly audited for any vulnerabilities. It initially released as Signal in 2014, but was in the works well before that under multiple names due to there being multiple moving parts involved before being fully folded into the Signal messenger umbrella. It exploded in popularity after well known whistleblower and privacy enthusiast Edward Snowden sung its praises after the poop hit the fan for the US govt. Since then it’s been Growing to around 125 million monthly users. Unlike WhatsApp, Signal collects almost NO data. I’ll display all the data they collect in a photo below.

That’s it! Just your phone number, which is needed for sign up. If you wanted to really get the most out of Signal, you even use a burner number from any number of sources online to further preserve anonymity.

It’s worth noting that Signal doesn’t just talk a tough game, they stand on business. They’ve been subpoenaed on a number of occasions and each time proved unfruitful for big brother due to the fact that signal can not see anything apart from ciphertext. They have a page dedicated to disclosing all of the times they have been given a subpoena to disclose any information, for further transparency, it can be viewed here.

Signal is also cognizant of the fact that not every government is receptive or welcoming to privacy for its citizens, which is why Signal allows for android users to sideload their app directly so they can access the service, circumventing the google play store.

The downside to Signal, if you could call it that is, the limited number of users that are using the app. 125 Million vs 2Billion, the odds are that significantly less people you know or even interact with use the app. But it’s growing as companies and governments alike, become more data hungry and invasive.

3. Session

The third, final and arguably most private messenger is Session, by The Oxen Project. The Oxen Project actually built this messenger using Signals source code and improved on their design to provide the one thing Signal does not, anonymity. Which for some is paramount in their communications. Session uses onion routing to bounce your message via different nodes they have globally to mask the origins of the message, so apart from being end to end encrypted, the ne has the added benefit of having their location masked from any prying eyes (very high level overview) so something like this is perfect for whistleblowers, or just anyone who doesn’t wanna hand out their phone number. Session comes with plenty of features like voice and video on top of their encrypted chats. Unlike Signal and WhatsApp, Session collects nothing. See below:

Session creates accounts using unique ID which are a string of numbers and letters, this is what you would give to people to initiate a private chat.

You could alternatively use the QR code feature making it a seamless process. Session also allows for groups making it great for people who have no need to save an extra phone number.

The downside to Session, is it has even less users than Signal. Session, at this point a little less than 200k users. So the odds someone around you uses it is EVEN slimmer. It’s a shame really because if you look at the data collected by various messengers below, it’s clear, Session values privacy and doesn’t get the love it deserves.

Conclusion

To close this out, if I were to rank them, based on MY needs and what I want my app to know about me, it would be a clear winner with Session, then Signal gets the silver and WhatsApp gets 3rd. I use all three, for different reasons, but I am making strides to get people off of WhatsApp and over to either Signal and Session. But WhatsApp built a great following before they got bought by FB so that’s still paying heavy dividends for Meta. As privacy becomes more of a concern for folks, we may see a shift, but for now this is how it is.