WhatsApp is more secure than texting, but there are still better alternatives

Jerry Galvin
5 min readJan 26, 2021

This might be news to some Android users, but iPhone users can tell you have an Android phone when you text them.

How? On an iPhone, texts from non-iPhones come in a green bubble, indicating the text is sent via the phone company’s text messaging. For iPhone to iPhone communication, the bubbles are blue, indicating that, rather than being sent via the carrier’s text message service, the message was sent through Apple’s encrypted iMessage platform through the internet.

Apple’s iMessage has some nice benefits over regular texting, like full resolution pictures, read receipts, and special effects like fireworks, but security is the biggest feature — because you get it by default.

Apple’s iMessage is encrypted and regular text messages aren’t

iMessages are end-to-end encrypted. End-to-end encryption means that no one can read the message as it makes its way from one iPhone to another iPhone via the internet. In this system, the only devices that should be able to read the messages are the sending and receiving Apple devices that have your iCloud account. Always keep in mind, even with end-to-end encryption, once the message is on the receiver’s phone, you can’t control what the receiver does with the message.

End-to-end encryption on iMessage is a contrast to text messages. When text messages were developed, they piggybacked on the cellular network backend communication protocols. Because of that, the messages had to be short — the reason why texts on your Nokia block phone were limited to 160 characters.

Text messaging, despite improvements to smartphones and to the cellular network, hasn’t really changed for a long time. That 160 character limit is still technically in place, even if smartphones hide this from you, by combining all the messages into one bubble. But because the messages are still only 160 characters, the short size of the messages doesn’t leave room for any additional information, such as an encryption mechanism. There’s not enough characters in a 160 character message to include extra information about how the message is encrypted.

iMessage isn’t available on non-Apple platforms. So when Android users text between each other, it goes through this ancient and limited texting system. Any messages sent between an iPhone and an Android also must use regular text messaging because there’s no iMessage for Android.

Theoretically, if you are only using text messaging, someone at the phone company could record every single one of your text message conversations, without your knowledge or permission. The cellular companies absolutely shouldn’t be doing that (without a warrant at least), but it is entirely possible that they could.

WhatsApp was my original savior from green bubbles

I originally used WhatsApp to avoid those dreaded green bubbles on my iPhone. For years, I had pushed my Android-using friends and family to the WhatsApp messaging platform and its end-to-end encryption. Sure, it was an extra app, but at least the phone company couldn’t spy on me. Also, it had a lot the same benefits as iMessage including read receipts and full resolution photos.

However, I recently deleted my WhatsApp account because of their controversial privacy policy changes. Even if the policy changes weren’t actually so bad, I’m not recreating the account — mainly out of distrust for Facebook.

WhatsApp was a really good service, but without this app in my arsenal for non-iPhone users, I’m back to green bubbles.

You’ve got nothing to hide, but wouldn’t you rather have privacy?

What’s the obsession with encryption, you ask? Well, first, the idea that fleeting daily thoughts sent to my family, or reminders to get milk, can be collected, without my knowledge, is creepy. Yes, there are plenty of platforms that also collect your daily thoughts and chats, like Facebook. But there, you expect that you’re being watched by Facebook. With text messaging, it is less obvious that someone could be reading your messages.

Remember that time someone sent you a social security number or important password over a text? Yikes. You don’t want that, if someone can record all the messages.

Where do we go from here

Ideally, there would be a single, default texting platform for all phones and it would have end-to-end encryption, keeping the message safe while going from phone to phone. Sadly, that seems exceedingly unlikely in any short term scenario.

Apple won’t be extending iMessage to Android, as they certainly must consider iMessage a competitive advantage and a type of network effect — you might only want to text with other blue bubbles.

Google and phone companies around the world were working on an iMessage-like service called RCS, and it is designed to work across different phone and computer types. However, while it will have an improved user experience, with many of the features of iMessage, the messages still won’t be encrypted.

You’re stuck protecting yourself

If RCS isn’t our savior for a single, encrypted texting platform between Android and iPhone, we’re all stuck securing our own messages. iPhone users have the great iMessage platform, but Android users — and those of us who text with Android users — still need another app.

Replacement for WhatsApp

When WhatsApp changed its privacy policy, many users started flocking to the Signal app. Owned by a non-profit, Signal has all the benefits of WhatsApp — such as encrypted messages, full resolution photos, group chats, calls, video calls, and read receipts — but without the worries of a Facebook privacy policy. It might eventually end up with the same problems as Facebook, but they aren’t collecting information about you and your contacts like Facebook is.

Having used Signal for years, in addition to WhatsApp, I can confirm Signal works great. The only problem is you have to get your fellow texters on board, and this could turn out to be impossible if you barely got them to WhatsApp.

WhatsApp is still better than no encryption, even with the data collection tradeoff

With that in mind, even after the privacy policy changes go into effect, Facebook still won’t be able to read your WhatsApp messages. They will remain end-to-end encrypted, unless you are interacting with a commercial entity.

If you already have WhatsApp and can’t convince your friends and family to change to Signal, WhatsApp may still be your best choice, if not everyone has an iPhone. WhatsApp is still much more secure than regular non-encrypted texting because the messages can’t be read while in transit from phone to phone—if you don’t mind sharing some data with Facebook.

At this time of great need, please consider giving to your local food bank. In the Chicago area, I recommend the Greater Chicago Food Depository.

WhatsApp and Signal logos

--

--

Jerry Galvin

Jerry Galvin has over 17 years of experience in engineering and cybersecurity operations. He currently is a business information security officer.