This article was taken from the May 2015 issue of WIRED magazine. Be the first to read WIRED's articles in print before they're posted online, and get your hands on loads of additional content by subscribing online.
We installed each service on a range of devices including an iMac, a MacBook Air and an iPhone 5. We conducted encrypted conversations and assessed each service for its design, performance and ease of use. Peter Eckersley, technology projects director for the Electronic Frontier Foundation (EFF), assessed each service for security best-practice criteria comprising encryption in transit; encryption from the provider; verification of contacts; security if keys are stolen; documentation of security design; code openness to review and code auditing. EFF's Secure Messaging scorecard can be found at eff.org
With a pixellated cartoon cat in its design, Cryptocat's slightly jocular tone belies its serious approach. It offers multi-platform compatibility and is utterly straightforward to install. It doesn't insinuate itself into your contacts or IM services, aside from Facebook Messenger. You just can't invite anyone to join in a conversation from within the app -- but if your pal knows the name of the chat, they can find it and join in. It offers little in the way of user tweaks, and conversations are simply displayed in a line-by-line format. Supposedly, you can send files, photos and videos, but we couldn't work out how to do it. Within minutes of inactivity, your conversation is terminated, never to be seen again. "The project gained prominence a little before it was ready," says Eckersley, "but it's a serious attempt to build a good and usable crypto tool." Teething problems now resolved, it scores maximum on EFF's ratings chart and all conversations are end-to-end client-side encrypted with Off-the-Record (OTR). Free; crypto.cat
8/10
SPEC****Platforms Mac OSX, iOS, Opera, Chrome, Firefox, Safari, Windows 7 Messaging medium OTR IM Compatible with Facebook Messenger EFF criteria fail None
Adium features an OTR plug-in and runs as a standalone desktop program. When messages come in, a cartoon duck animates itself in the dock to alert you, coupled with the calming sounds of Tokyo station's PA system. It's highly customisable, and the large IM pane with tabs is a joy compared to, say, chatting within a Gmail window. You can add accounts linked to most common IM services, but it seems a bit flaky and failed to connect to a Yahoo! account and Twitter feed. Correspondents need to use an IM client with native support for OTR for encrypted chats. It has a lot going for it, but Eckersley felt that Adium struggled to give users a clean experience if they want to be signed in from multiple locations and computers. Free; adium.im
7/10
SPEC Platforms Mac OSX Messaging medium OTR IM Compatible with AOL, MSN, Google Talk, Facebook Chat, Jabber, Bonjour, Twitter, IRC EFF criteria fail Code not audited
The gimmick-free desktop/browser version seems positively dull at first sight, but emoticons that are substituted by giant cartoon memes of famous faces liven things up. "Based in Germany but funded by the founders of VKontakte, the largest social media network in Russia, Telegram seems to be maturing swiftly," says Eckersley. The desktop version offers a reasonable level of customisation and lets you meddle with the IP settings (if you know your TCP from your HTTP). A timer that allows secret messages to self-destruct is simple but effective. Pictures can be sent but can only be viewed on mobiles by keeping a finger pressed down on the screen -- if you take a screenshot, the app generates an alert that's sent to all parties. The mobile version is a virtual visual clone of WhatsApp. Free; telegram.org
9/10
SPECPlatforms Android; iOS; Windows Phone; Mac OSX; PC; Linux; web browser Messaging medium OTR IM Compatible with No others, uses proprietary IM EFF checklist fail Code not audited
PGP adds encryption to Apple Mail when required. Eckersley isn't a fan: "PGP is uniquely infamous for being hard to use. Like other software designed in the early 90s, it forces users to solve a lot of tricky problems." One such palaver is the process of creating a secure key, which is uploaded to a server. Also, when sending email, an option appears for encrypting and signing, then a prompt asks you for the secure key whenever you send or receive encrypted messages. Message subject titles aren't encrypted but content appears as gibberish in the inbox so snoopers can't read protected messages. It can be used with existing email clients and connects to key servers using SSL, but messages must be initially routed through Apple Mail. Free; gpgtools.org
7/10
SPEC Platforms Mac OSX Messaging medium Email Compatible with OP/IMAP clients EFF criteria fail Secure key can be stolen; code not audited
This article was originally published by WIRED UK
