6

Recently Google rolled out the feature to send SMS/Chat messages over Web via their Android Messages app. The approach seems similar to the WhatsApp Web Client. What I didn't find however are technical details on how Google ensures privacy and confidentiality.
 
The setup is also done via QR code and suggests to me that there seems to be some sort of secured channel between the phone and the web browser. I currently believe that due to this, the browser ultimately just receives and sends the information to the phone, where everything is processed. It somehow has to be as I am sure that several people have encrypted their devices. The one thing that gives me doubt is the Smart Reply feature. Would the smart reply be created on the phone and relayed to the browser or would the browser do it on its own?

The question to me now is if this is how it works and how is it ensured that everything I would do on the web app just goes to the phone and not somewhere else?

1 Answer 1

7

Not sure if you found any answer, but have had the same question RE security/privacy and came across this thread higher up on google. Was able to find some information but not much. Some of the below is inferred as mentioned.

To confirm/make clear - this is what found between wireshark/monitoring, on the web, googles help page below, etc. and not all of this is for-sure/confirmed, I tried to make clear which are speculation/assumptions and which are not, just keep in mind :)

Encryption

Note that at it's core Android Messages is built around RCS (granted also supports SMS), and unfortunately like SMS - RCS as stands today is NOT end-to-end encrypted which is very unfortunate especially considering Google's one of the main players in RCS's development, but that's a separate topic.

Linking & Browser Storage

From: https://support.google.com/messages/answer/7611075?hl=en

[...] Messages for web sends SMS messages using a connection from your computer to your phone, so carrier fees will apply, just like on the mobile app.

Note: The QR code for Messages for web is unique to your computer and pairs the mobile app to that computer. You can pair your Messages account on multiple devices, but only one will be active at a time. When you open Messages for web on a computer, your conversations on any other computers or browser tabs will become inactive.

Note: Your latest conversation threads, contacts, and other settings will be encrypted and cached on your browser. If you don’t use your Messages account for 14 days, you’ll automatically be signed out for security reasons.

To clarify the above only covers the storage of that data on your computer/browser.

Browser to Google / Google to Browser

Due to it's nature (within a browser/web HTTPS) the communication between your computer and google is at least encrypted using TLS 1.2 (dependent on browser/environment*) and communicating with what you would expect / play.google.com and ssl.gstatic.com etc. so that side is secure on transmission/receipt.

Google to Phone / Phone to Google (Unknown) (Speculation) Would assume and expect/pretty confident that SSL/TLS is handling the connection but can not say for sure (someone can wireshark to confirm but very unlikely it's not SSL).

What's doing the sending

From what information IS available, all say yes the phone IS doing the actual sending/receiving You can turn off your phone, or go into Airplane mode/no data connection and Messages for Web will not work until it comes back on. While that doesn't prove it on it's own, all major publications have stated as fact from the initial announcement

From same page linked above:

On your phone, you need: [...] Wi-Fi or data connection

From the above information, it would make sense that as you mentioned it's just creating a link/sync between your Phone and the Browser client, with your phone doing all the processing which could include Smart Replies (speculation) - though also while logged into your Google Account / associated with it, if you have your typing data stored with Google for personalization etc then Google could be doing that on their end without hitting your phone, but that would seem like more of a hassle since need a two-way sync anyway.

Privacy

On the privacy side, really should check out the Privacy Policy as I haven't had a chance to. Unfortunately it appears it's just their overall Privacy Policy & Terms which is pretty all-encompassing, but that's often a good way to get details on what/why/sometimes how.

Overall

Unfortunately regarding your question how to confirm it's just going to phone and no where else, that is hard to get an answer for and really just comes down to trust in Google. Remember when sending from the web it's not going straight to your phone, it's passing to Google which then is passing it to your phone/vice versa.

You wouldn't THINK it's going anywhere else but never know, additionally keep in mind that by opting into Android Messages on the Web your SMS/RCS data is passing to/through Google where it may not have been before. I'm NOT sure on this, but I would be curious if with Android Messages on its own (no web link) google has/had any access to full/raw SMS/RCS messages/data (?) - knee jerk I wouldn't think so (though they usually do have your typing data and WHO you text/frequency - metadata etc).


If anyone else has any additional information on the details of how this is working would love to see as well!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .