WhatsApp's new policy: Signal high on privacy, misses out on backup

Since Signal is an open source app, its claims can be verified

Signal Messenger seems to have taken India by storm, what with several people choosing to shift to it from WhatsApp over concerns that the latter’s new privacy policy might compromise their data.

Seen as a more secure option, not many may know that Signal has what might be called a WhatsApp connection. Brian Acton, one of the co-founders of the Signal Foundation, the non-profit organisation behind the app, also co-founded WhatsApp. Acton, however, moved out of WhatsApp in 2017, three years after selling the company to Facebook for $19 billion over disagreements with Facebook CEO Mark Zuckerberg about monetising the app. A year later, he invested $50 million in Signal Foundation.

Acton said he regretted his tryst with Facebook. “At the end of the day, I sold my company. I sold my users’ privacy. I made a choice and a compromise. I live with that every day,” he said.

Signal maintains that its prime focus is on privacy, which is embedded in its end-to-end encryption protocol — something WhatsApp also promises. This means even the app-maker has no access to your chats. The foundation says its goal is to “build open source privacy technology” that “protects free expression and secure global communication”. 

Open source, in fact, is one of the reasons people like Tesla CEO Elon Musk have been vouching for Signal. Open source makes the app open to scrutiny by researchers who can verify whether the encryption performs the way the app claims and also publicly suggest flaws for rectification. (An open-source software is one in which the source code is released and the copyright holder has granted users the rights to study, change, use and distribute the software to anyone — and for any purpose.) Incidentally, WhatsApp uses the open source Signal protocol for encryption. 

This scrutiny by third-party developers makes the app more robust and secure than closed or semi-closed apps. “The key problem in apps is that there is no agency that validates the claims of the app-maker on privacy or security — unlike in mobile devices, where you have the BIS (Bureau of Indian Standard),” says Faisal Kawoosa, founder of techARC, a technology market research firm. 

Signal offers more or less the same things as WhatsApp: You can text, send audio messages and make video calls to people who are also on Signal. It also offers emoji stickers. 

Experts say the only data that Signal collects is the user’s phone number, and work is on to ensure that even this is not required by building encrypted contact servers. All other information – such as an individual’s profile, picture and messages -- are encrypted. 

Signal also has more security features such as additional password protection; blur option so that you can obscure important pictures or documents; disappearing message option (which Telegram and WhatsApp have also recently introduced); a once-view option that allows you to remove a picture from a chat after it has been seen. There are also privacy settings to ensure that your IP address cannot be seen by the contact. 

Unlike WhatsApp, Signal does not have a business version of the messaging system to complicate the relationship between those who use it for simple chatting and those who want to engage in business. 

However, like WhatsApp, you can link your Signal account to a laptop or PC. But then, unlike WhatsApp, you will not get the previous message history. 

While Signal scores on privacy, it does have some problem areas. For instance, there is no provision to store your chats or other data, like pictures, in the cloud. So, if the phone gets misplaced or you have cleared the data, you have to start afresh on a clean slate. Since all the data is stored in the phone, the only way to transfer it is manually. This, again, has been done to ensure data privacy.

If you are still worried, you can go to “request account info” and download a report, which will be out in the next few days and which will provide details of the data they have collected.