0

I was wondering how we should transfer our sensitive data (identity card softcopy, plaintext-password, secret documents, etc) over the internet securely, the following are a few related questions:

  • Is the security level of current widely used application such as WhatsApp, Telegram or Facebook Messenger sufficient for us to transfer the sensitive data? I believe this method is the most widely used by public users now.
  • Is the encryption feature (PGP) in email secure enough to transfer our sensitive data?
  • I think the question needs more details: 1. How sensitive are the data, should the transfer be resistent only against some local attacker or also against government agencies which might get a national security letter or similar against a company providing a transfer service or app? 2. Do you kind of control both sender and recipient and thus have an arbitrary choice of software? 3. Do you trust the recipient already, i.e. have some kind of trust anchor to make sure that you don't transfer information to the wrong party? Please add these details by editing your question instead of in a comment. – Steffen Ullrich Feb 7 at 6:05
  • Product recommendations are off-topic, so I am removing that question. – schroeder Feb 12 at 10:06
2

Is the security level of current widely used application such as WhatsApp, Telegram or Facebook Messenger sufficient for us to transfer the sensitive data? I believe this method is the most widely used by public users now.

Facebook Messenger and Telegram doesn't use end to end encryption by default. Your data is encrypted during transmission, but Facebook and Telegram can read your messages while it passes through its servers and they store your messages as well. Both Facebook and Telegram supports end to end encryption, but this is not default. You have to turn on Secret Conversation/Chat to enable end to end encryption. WhatsApp uses end to end encryption by default, so WhatsApp is much more secure than either in its default configuration.

However, users that wishes to use any of those services for transferring highly sensitive data need to take extra steps beyond default. In particular, in addition to enabling end to end encryption, you need to verify the other party's encryption key out of band, because otherwise you may be using an end to end encryption to talk to your adversary rather than your intended recipient. Also, Telegram have also been criticized for developing their own encryption scheme, instead of using well known secure ones. WhatsApp also has been the subject of some criticism in the way it can do transparent rekey and resend, which may leak some of your most recent messages.

Among the major encrypted instant messaging software, Signal is probably the one that's garnered the least criticism in its implementation of end to end security. WhatsApp and Facebook Messenger's end to end encryption protocol are based on Signal's protocol. All of Signals' clients and server implementations are open source, and the Signal Protocol is based on long respected cryptographic primitives. It's one of the few messaging apps that achieved perfect score on EFF's instant messaging score card.

Is the encryption feature (PGP) in email secure enough to transfer our sensitive data?

There's no known vulnerability in the basic protocol of PGP encryption as of yet. There are from time to time implementation issues like how some features of HTML mail clients interacts badly with PGP and can thus be used to leak information (EFAIL attacks). Most of the latest mail clients have patched these issues. The base cryptography itself is still solid as far as we can tell.

As to whether it's secure enough, you will have to decide, based on the sensitivity of your data and your threat model. If your main concern is preventing leaks from common petty criminals, pretty much any of these services should be secure enough. If you're talking about targeted attacks from government agencies, especially hostile governments, then not all of the services above are sufficient, and you likely need to make changes in the rest of your online habits, not just your messaging service.

-2

Q1. Both WhatsApp, Viber are using end to end encryption method. therefore it has enough security to transfer data. But they store data temporarily. Facebook store data permanently.

Q2. You can use SFTP/FTPS/HTTPS or AS2. AS2 work on HTTPS. You can use paid service to transfer Sensitive data. You can request your features as well. But Free services cannot be guaranteed.

Q3. Use your own email server with encryption. That is the best way. PGP is secured, but some issues have been found in PGP encryption. Email is not secure without encryption. Therefore at least PGP should be used.

  • I think AS2 would need a deeper explanation since most are not familiar with the protocol. Apart from that AS2 does not necessarily use HTTPS, it can also use plain HTTP since the actual protection is done by the SMIME message contained in the HTTP body. It is also not clear why paid services will offer better protection. Also, I've removed the reference to a specific company since it looked more like an advertisment, i.e. there was no specific reason to include exactly this company. – Steffen Ullrich Feb 7 at 5:45
  • Why not use any standard, available email server? Why is the "best way" to run your own server? You can use PGP over Gmail, Yahoo, Outlook, etc. – schroeder Feb 12 at 10:12
  • Facebook Messenger also uses end-to-end encryption. Why was that not included in your list? If encrypted, does it matter how long the chats are stored? Please include a citation for "WhatsApp stores data temporarily" and "Facebook Messenger stores data permanently". – schroeder Feb 12 at 10:13
  • @schroeder i don't know about that. therefore i didn't mentioned it. – serverAdmin123 Feb 12 at 10:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.