Encrypted Communication Explained: Messaging, Email, and Voice

Introduction

In the physical world, if you whisper to a friend in a soundproof room, no one else can hear you. In the digital world, “whispering” requires complex mathematics. Without encryption, your messages are like postcards: anyone handling the mail (ISPs, telecom carriers, hackers) can read them.

This guide explains End-to-End Encryption (E2EE)—the gold standard for digital privacy—and differentiates it from standard transport encryption.

Core Concepts

1. Transport Encryption (TLS/HTTPS) vs. E2EE

• Transport Encryption: Protects data in transit between you and the server. The server decrypts it, reads it, and stores it. (e.g., Gmail, Facebook Messenger standard chats). The company can read your messages.
• End-to-End Encryption (E2EE): Data is encrypted on your device and only decrypted on the recipient’s device. The server only passes the encrypted blob. The company cannot read your messages even if subpoenaed.

2. The Danger of Metadata

Even with E2EE, “Metadata” (data about data) can reveal everything.

• Content: “Hello, let’s meet at 5 PM.”
• Metadata: Sender: You. Recipient: Activist. Time: 4:59 PM. Location: Café X. Intelligence agencies often rely on metadata (“Who talks to whom”) more than content to map networks.

3. Forward Secrecy

A property of modern cryptographic protocols (like Signal). If an attacker steals your private key today, they cannot decrypt past messages recorded years ago. Each message cycle generates new ephemeral keys.

Threat Model Considerations

Who this protects you against:

• Service Providers: Signal/WhatsApp cannot be forced to hand over message content because they don’t have the keys.
• Network Interceptors: Packet sniffers on Wi-Fi or ISP levels see only static.
• Database Breaches: If the server is hacked, the messages stored there are unreadable.

Who this DOES NOT protect you against:

• Endpoint Compromise: If an attacker has malware on your phone (screen recording, keylogger), encryption is useless. They see what you see.
• Physical Access: If the police seize your unlocked phone, they can read the open app.

Practical Steps

1. Use the Right App

• Signal: The industry benchmark. Open source, minimal metadata, funded by non-profit.
• WhatsApp: Uses Signal protocol for E2EE, but collects massive metadata (who you talk to, when, contact lists) for Meta/Facebook.
• Session: An onion-routing based messenger that doesn’t even require a phone number (maximum anonymity).

2. Verify Keys (Safety Numbers)

E2EE relies on trust. “Am I really talking to Alice, or to Malloy pretending to be Alice?”

• Signal/WhatsApp allow you to scan a QR code on your friend’s screen. This “Safety Number” verification mathematically proves there is no Man-In-The-Middle (MITM).

3. Avoid SMS and Unencrypted Email

• SMS: Plain text. Carriers store it for years. Easily intercepted via SS7 vulnerabilities.
• Email: Generally not E2EE. PGP is effective but famously difficult to use. For secure email, use Proton Mail or Tuta (formerly Tutanota), which handle encryption automatically between users.

Common Misconceptions

Verification Steps

1. Source Code Audit: Serious privacy apps (Signal, Standard Notes) publish their source code on GitHub for experts to audit.
2. Verify Safety Numbers: Theoretically, if you and a friend compare safety numbers and they match, the channel is secure. If they change unexpectedly, you are being intercepted (or they got a new phone).
3. Metadata Check: Review the “App Privacy” labels on the App Store to see what data is linked to you. Compare Signal (no data) vs. Messenger (contacts, location, purchase history, search history).

References

• Signal Protocol Whitepaper: “The Sesame Algorithm: Session Management”
• EFF: “Secure Messaging Scorecard” (Archived, but principles remain)
• Johns Hopkins University: “Security Analysis of the Signal Protocol”