Signal vs WhatsApp: Battle of the Messaging Apps

With more than 2 billion users in over 180 countries worldwide, WhatsApp is the most popular communication platform on the planet. However, with data privacy becoming a greater concern, users have been seeking alternative messaging services which they believe prioritise online security. 

In the wake of the announcement of changes to WhatsApp’s privacy policy, alternative messaging app Signal leapt to the number one spot in the app store in 70 countries and has seen continued growth since. So, is Signal a more secure and private alternative and can it really provide strong competition to the mobile messaging giant that is WhatsApp?

What caused people to move away from WhatsApp?

On 4th January 2021, WhatsApp announced changes to its privacy policy which, if not accepted by the 8th February, would lead to the deletion of users’ accounts. Due to unclear wording and misinterpretation by readers, this announcement was met with a massive backlash as users feared more of their personal information would be collected by WhatsApp and shared with its parent company Facebook. 

As a result, millions of messaging app users sought to download alternatives which saw an increase in downloads for applications like Telegraph and Signal. The BBC reported that in the week after WhatsApp announced the change, Signal was downloaded 8.8 million times worldwide, compared with 246,000 times the week before.

This incident is compounded by the fact that Facebook has come under scrutiny in recent years, particularly after the Cambridge Analytica scandal in 2018. Many users are now more concerned about how much of their personal data is being collected and used by Facebook and shared with third parties.

In 2017, action was taken against Facebook by European regulators for the company’s sharing of WhatsApp users’ phone numbers with Facebook for advertising purposes which was in breach of data protection regulations due to the opt-out nature of this permission. This was something that Facebook had previously said it would not implement. Due to this loss of faith in Facebook, space has opened in the market for alternative messaging apps to grow their user base.

 Related article: How Safe is Facebook?

What is Signal?

With testimonials on its website from Edward Snowden, internationally renowned security technologist Bruce Schneier, and CEO of Twitter Jack Dorsey, Signal presents itself as a mobile messaging company that holds privacy and security at its core. 

Signal is supported by the non-profit Signal Foundation, which was set up in 2018 by Moxie Marlinspike (SignalMessenger CEO) and WhatsApp founder Brian Acton, who left the company in 2017 after worries about the introduction of targeted advertising and commercial messaging into WhatsApp.

Where Facebook’s business model is based on making profits through advertising, Signal is supported by grants and donations. CEO Moxie Marlinspike stated that Signal is ‘organized as a non-profit because we feel like the way the internet currently works is insane’. 

Signal did not want to become a media company that amplifies content and advertising in the way Facebook does. The app’s COO Aruna Harder states that ‘as a non-profit, we simply need to break even’ in response to worries about whether the app would be able to maintain its business model with increasing user numbers.

Image credit: BBC News

How do WhatsApp and Signal features compare?

Platform support

WhatsApp: WhatsApp has support for Android, iOS, web, Mac, Windows and Windows Phone. To use WhatsApp web, user’s phones must be on, with a consistent connection. You also cannot use the same WhatsApp account on multiple devices as the account is tied to the device. Chat history is deleted when you sign in to a new account unless users have created a backup.

Signal: Signal is supported on Android, iOS, Windows, Mac OSX. It also has a dedicated client for Linux users. Signal can also only be registered on one mobile device at a time, but you can link Signal to Signal Desktop. Similarly to WhatsApp, message data is stored on the user’s device, so chat history will not be present if moving to a new device unless users have created a backup.

Sign-up requirements

WhatsApp: Users sign up using their phone numbers and are then sent an activation code to activate their account. WhatsApp automatically finds contacts through your phone contacts and uses your phone number as identification.

Signal: Signal users also must sign up and create an account using their phone number. The app needs to access your phone number and contacts to work and also sends you an activation code in the same way as WhatsApp.

Messaging capabilities

WhatsApp: Started as an alternative to SMS, WhatsApp supports the messaging of a single person or group, the sending of photos, stickers, gifs, videos, documents and locations, as well as allowing users to make voice and video calls.

Signal: Signal supports text chats, group chats, stickers, sending photos, gifs, files, contacts and locations. It also has a voice call and a video call option. Signal is also able to work reliably in all countries as it securely circumvents internet censorship that is present in some countries, whilst WhatsApp is blocked in some countries like China.

Signal vs WhatsApp: which is more private?

Encryption

Both Signal and WhatsApp use end-to-end encryption, which means that only you and the person you are communicating with can read or listen to what is sent. Even the messaging apps themselves cannot access this information. These messages are secured with a digital lock and only the sender or recipient has the key (the code) to unlock them. 

Source code

All applications can suffer vulnerabilities and both Signal and WhatsApp have had such instances in the past. However, as WhatsApp has a closed box codebase, it can take longer for these vulnerabilities to be detected and resolved, whilst some potential targets can remain unknown until they’re exploited. An example of this is from 2019 when a vulnerability in WhatsApp’s VoIP stack was used by intelligence agencies to inject spyware. 

On the other hand, Signal’s open-source code means that developers around the world can continually work collaboratively on the app to help maintain its security and fix bugs and errors. Thus, Signal has less potential for hidden vulnerabilities in its code.

Data collection

The contents of WhatsApp messages, voice calls and video calls cannot be viewed by WhatsApp, Facebook or the authorities. WhatsApp cannot see your shared location and you can also set messages to disappear after a certain amount of time. 

However, the app does collect the metadata attached to your chats, such as the sender, the time, and who it was sent to. The majority of the information WhatsApp collects is a user’s metadata, which includes information such as how you interact with other users, your profile photo, any statuses you set and diagnostics information. This can then be shared with companies under the umbrella of Facebook.

The Signal app does not store metadata as WhatsApp does. Within the legal section of Signal’s website, it says that ‘Signal is designed to never collect or store any sensitive information’. Signal itself cannot access or decrypt messages or call contents. Signal does not sell, rent or monetise its users’ personal data or content and states that users own the information they submit through Signal’s services.

Among fears over data collection with the introduction of its new privacy policy this year, WhatsApp stated that the new update is mainly geared towards how businesses use the app. The update will have features such as giving businesses the option to use Facebook secure hosting services for WhatsApp chats or to let users interact with businesses through WhatsApp by clicking Facebook or Instagram ads. 

Some user information will then be passed to Facebook and its affiliated apps, but this is only for shopping-related services. New commerce features will allow goods to be displayed in WhatsApp which may be used to tailor ads on Facebook and Instagram.

Third parties

WhatsApp works with third-party providers and other Facebook companies to help operate, improve, customize and market their services. If you use one of their services with third-party services or Facebook Company Products, these third-party apps may receive information about you. 

The example WhatsApp gives for this is if you use the WhatsApp share button on a news service to share a news article with your WhatsApp contacts or groups, the third party (the news service) may be able to collect data from this.

Similarly, Signal also works with third-parties to provide some of their services. For both apps, they state that these third-parties operate under their own privacy policies. If users use third-party services like YouTube, Spotify, Giphy in connection with both WhatsApp and Signal’s services, the terms and privacy policies of those third-party platforms govern your use of them.

Identification

Whilst Signal and WhatsApp use your phone number as your identity, Signal has introduced pin codes as a means to try and move to a more secure and private way of identifying users. This also means that if you lose access to your phone number, your Signal account can still be accessed using your Signal Pin which you are automatically prompted to create regularly when using the app. 

Additional security measures

Within the app itself, Signal has some features like its keyboard incognito mode which prevents keyboard apps from retaining what you type. This is important as your smartphone’s keyboard can become compromised by malicious actors, which in turn compromises the security of any apps where you type in passwords or sensitive information. 

In the privacy menu, you can enable further security features such as a screen lock with a time-out length of your choice, a screenshot blocker and the addition of biometric or extra passcodes to unlock your screen. This is not possible for WhatsApp whose website notes that users may still capture screenshots of chats, or make recordings of calls if they are part of the group or message stream.

So, how do WhatsApp and Signal measure up?

Signal and WhatsApp have a large majority of similar features, including messaging, calling, sending files and starting group chats. Upon testing, I found that both apps have clear and simple interfaces which are intuitive to users and easy to get the hang of.

The main differences between the apps lie in their privacy policies. On the whole, as both WhatsApp and Signal use end-to-end encryption, they have a high level of general security. However, whilst WhatsApp shares its metadata with Facebook, Signal does not store or share metadata with associated companies. In addition, due to Signal’s open-source software, it can be easier for many programmers to fix bugs, security breaches and issues in a way that isn’t possible for WhatsApp. 

Whilst Facebook and WhatsApp have had past controversies regarding privacy, Signal markets itself as a company and app whose focus is protecting the privacy of their users, which has appealed to many who have started to mistrust ‘big tech’.

However, there’s also habit and convenience to account for, and it would be easier for users who are already using WhatsApp to stick with it. As the largest mobile messaging platform, it is likely that many of your contacts may already be using WhatsApp, which makes it very easy to connect with them. Once a user has their contacts, group chats and chat logs in one place, it can be less desirable to change to a new app. 

Having said that, Signal is still a relatively new and smaller-scale messaging app, so time will tell how the company adapts and changes as its user base grows!

AR.