#1: Encryption

Definition: In technical terms, it’s the process of converting plaintext to ciphertext. In simpler terms, encryption takes readable data and alters it so that it appears random. Types: The three major encryption types are DES, AES, and RSA.

DES encryption was accepted as a standard of encryption in the 1970s, DES encryption is no longer considered to be safe on its own. A more modern 3DES is a version of block cipher used today. Instead of using a single 56-bit key, sDES uses three separate 56-bit keys for triple protection. The drawback to 3DES is that it takes longer to encrypt data. Also, the shorter block lengths are encrypted three times, but they can still be hacked. Banks and businesses still rely on it at this point in time, but newer forms may soon phase out this version. You probably won’t use DES or even 3DES on your own today.

AES encryption is one of the most secure encryption types, Advanced Encryption Standard (AES) is used by governments and security organizations as well as everyday businesses for classified communications. AES uses “symmetric” key encryption. Someone on the receiving end of the data will need a key to decode it.AES differs from other encryption types in that it encrypts data in a single block, instead of as individual bits of data. It works in so many applications, and it’s still the most widely accepted and secure encryption method for the price.

RSA Encryption is another popular encryption standard, it is widely used for data sent online and relies on a public key to encrypt the data. Those on the receiving end of the data will have their own private key to decode the messages. It’s proven to be a secure way to send information between people who may not know each other and want to communicate without compromising their personal or sensitive data.

Problems: Some encryption is more easily hacked than others. While some companies or individuals choose encryption type according to standards dictated by legal or industrial regulations, others may simply choose their type based on personal preference, which isn’t always the strongest. Also, only one type of encryption isn’t enough. Since a message travels a long way — rest, transit– it needs to be encrypted through the whole process — any point-of-weakness can become fatal.

Zangi Score: 

Zangi Secure Messaging app uses not one, but multi-level encryption, securing the entire journey of your content and metadata, from start to finish, at rest and during transit. — RSA-2048 and AES-GCM for client-server data transport encryption — Advanced Encryption Standard (AES-256) for symmetric encryption — Elliptic Curve (Curve25519) cryptography for authentication — Elliptic Curve Diffie-Hellman (ECDH) for key agreement — Secure Hash Algorithm (HMAC-SHA256) for message digest — Customized TLS/Noise for encrypting the transport layer

#3: End-to-end Encryption

Definition: End-to-end encryption (E2EE), which is a very popular term among messengers, is a method of secure communication that prevents third-parties from accessing data while it’s transferred from one end system or device to another. In E2EE, the data is encrypted on the sender’s system or device and only the recipient is able to decrypt it. Nobody in between, can read it or tamper with it. If a messenger uses the term “End-to-end encryption” instead of only “encryption” take that as a big plus.

Problems:  All of the above carry the HUGE caveat of implementation. For example, a communication might be encrypted by keys held only by the two endpoints, but (without the user’s knowledge) also encrypted with a key held by the provider. A third party observing the line will not be able to read the messages as they don’t have any of the keys. However, the user loses their privacy to the messaging provider. [Apple, iMessage]

Zangi Score: 

With Zangi Secure Messaging app, encryption keys exist only on user devices and nowhere else (encryption algorithms: AES-256, Curve25519, ECDH, HMAC-​SHA256​​). Content is encrypted locally on user devices and is only accessible to intended recipients. Zangi never has the decryption keys.

Secure Messaging Apps: How Safe They Really Are?

#4: Zero-knowledge/ No backdoors

Problems: In times of urgency, the government has always required access from messengers and SMS services for needed information, even when messengers claimed they do not have an entry. And as experience has shown, almost all messengers were able to open a backdoor in times of emergency or there was some way into the system. They intentionally leave flaws, just in case.

#5: No profiling, Data Protection

Definition: Data profiling is the process of reviewing source data, understanding structure, content and interrelationships, and identifying the potential for data projects. Many apps like Amazon, Uber, and Starbucks openly collect data from users to better analyze their markets. But in the world of messaging, we put out so much more personal info and intimate conversations, that no user agrees for their data to be collected.

Problems: Facebook, WhatsApp time and time again, with the yearly data breaches have shown that it’s dangerous to trust Facebook with our data. And while Facebook says it can’t access messages sent over WhatsApp and doesn’t have access to messages sent via Facebook Messenger, the company does mine your usage of those apps for other data, like how often you talk to someone and whose phone numbers you have stored in your smartphone’s address book. The biggest problem here is the denial of data collection, and then the “surprise” data breaches that follow.

No ads, no banners, no popups, no takeovers, there’s none of that. Zangi is ad-free, and will always stay that way. Zangi secure messaging app does not sell analytics or usage data to anyone because they do not have anything! Zangi does not do big data, does not leave traces on the internet because it works without storing anything on any servers. The company is fully funded by corporate customers, and not dependent on any other means of funding.

#8: No phone number required

Definition: To register for an account, messaging apps ask for a phone number, email address, or username. This information is asked to differentiate each user, to verify each user’s account uniquely and for contact synchronization to work. But as messaging apps are moving towards more secrecy, users are asking for more anonymous registration options and they don’t want to provide their true identity or phone numbers anymore.

Problems: Not asking for a phone number means the app won’t have this information about you, but it also will make finding existing contacts that use that messaging app more difficult. You’ll have to add each contact manually one by one. In reality, switching away from phone numbers doesn’t give the app more security, it’s simply a way of more anonymity.