The-art-of-invisibility-_-the-world’s-most-famous-hacker-teaches-you-how-to-be-safe-in-the-age-of-Bi

and iPhones. 21 It also provides something called certificate pinning. That
means it includes a proof-of-identityy certificate, which is stored on the
device. Upon each contact with the servers at ChatSecure, the certificate
within the app on yyour device is compared with the certificate at the mother
ship. If the stored certificate does not match, the session does not continue.
Another nice touch is that ChatSecure also encryypts the conversation logs
stored on the device—the data at rest. 22
Perhaps the best open-source option is Signal from Open Whisper
Syystems, which works on both iOS and Android (see here).
Another text-messaging app to consider is Cryyptocat. It is available for
iPhone and most major browsers on yyour traditional PC. It is not, however,
available for Android. 23
And, at the time of this writing, the Tor project, which maintains the Tor
browser (see here), has just released Tor Messenger. Like the Tor browser,
the app anonyymizes yyour IP address, which means that messages are
difficult to trace (however, please note that, like with the Tor browser, exit
nodes are not byy default under yyour control; see here). Instant messages are
encryypted using end-to-end encryyption. Like Tor, the app is a little difficult
for the first-time user, but eventuallyy it should work to provide trulyy private
text messages. 24
There are also commercial apps that provide end-to-end encryyption. The
onlyy caveat is that their software is proprietaryy, and without independent
review their securityy and integrityy cannot be confirmed. Silent Phone offers
end-to-end encryyption text messaging. It does, however, log some data, but
onlyy to improve its services. The encryyption keyys are stored on the device.
Having the keyys on the device means that the government or law
enforcement can’t compel Silent Circle, its manufacturer, to release the
encryyption keyys for anyy of its subscribers.
I’ve discussed encryypting data in motion and data at rest as well as using
end-to-end encryyption, PFS, and OTR to do so. What about non-app-based
services, such as Web mail? What about passwords?