Your 'private messenger' may not be so secure after all

As Russian tanks rolled into neighboring Ukraine late last month and the Russian government blocked its citizens' access to Facebook, use of the Tor network - which lets people use the Internet without revealing their identities or locations - shot up in the country.

Tor - short for "the onion router" - encrypts Internet traffic using a fancy mathematical formula. (Imagine sticking some Web traffic data into one end of a math machine, and it coming out the other end garbled, at least to anyone without access to the math.) Next, it sends that traffic on a wild ride, bouncing it among volunteer computers around the world so that traffic can't easily be traced back to you.

It's one of a few ways people can hide their online activities from governments, companies and even family members. Some people use Tor because they're activists concerned for their safety, Tor Project fundraising director Al Smith said. Others are trying to hide Christmas presents from their spouses.

Russia's censorship of how the war is playing out in Ukraine might be getting people to think about their own privacy and how they could communicate with friends and family safely during a conflict. The U.S. government hasn't blocked access to major social media sites as Russia and China have, but Americans still have plenty of reasons to hold their data close to the vest. Many communicate with family in countries with Web surveillance - such as China - while others just want to hide from constant targeted advertising.

Finding reliable private messengers and browsers is easier said than done, though. When some companies say their products are "private," they mean your data isn't visible to other users. Others hide your data even from themselves.

"Every entity and company might mean something slightly different by private," Smith said. "You almost have to be an expert to understand which tools to use."

Here's what to look for when you evaluate the privacy of browsers or messengers.

• Is the messenger end-to-end encrypted?

Usually, the privacy settings you see in your favorite apps are actually visibility settings - what can other users learn about you from looking at your profile and activity?

But "privacy" involves broader questions. Companies can hide your data from onlookers while retaining access to it themselves, for example. That opens a host of privacy concerns, Smith said. What if the company sells or shares that data? What if the government demands access?

Some privacy products use encryption to hide data from third parties, from themselves or both. When data is cloaked during transit and viewable only to the sender and receiver, it's considered "end-to-end encrypted." While your data's security depends partly on the app's encryption protocol - or the math they use to scramble the data - end-to-end encrypted services are more private because the company itself doesn't have access to your information.

Sign up for the daily JWR update. It's free. Just click here.

Facebook Messenger and Telegram allow you to create one-off encrypted chats, but these messengers are not end-to-end encrypted by default. That means copies of your data could be stored on the companies' servers. Apple's iMessage and Facebook's WhatsApp are end-to-end encrypted by default. But if your iMessages are syncing to iCloud, Apple has the encryption key and could turn them over to law enforcement. As for WhatsApp, it's unclear how much data the product shares with its parent company, Meta, which has been under the spotlight for its data-sharing practices.

Signal is end-to-end encrypted by default, doesn't have the key to decrypt your messages and isn't owned by an advertising giant. For more tips on keeping your messages out of the wrong hands, check out Help Desk's guide to private texting.

• Does the browser hide your traffic, or just forget it?

If you open an incognito window on Google's Chrome browser, it forgets everything you did after you close the window. But it doesn't hide that you did it. That means Google, your Internet service provider and anyone they shared the data with could see which sites you visited.

Standard browsers don't cloak your Web activity. If you're worried about state censorship or surveillance, that's not a good setup. Opt for the Tor browser or the Brave browser's "Tor windows," which the company says come with relatively fewer privacy protections. There's also the Onion Browser, which runs on Apple's iOS for mobile devices. (The Tor Project makes a Tor browser version for Android.)

Similarly, virtual private networks (VPNs) hide your Internet activity from snoops, but they also can log it. That means state actors could ask for records of the sites you visit. Here, the Tor browser is a safer option.

If corporate surveillance and targeted advertising are your main concerns, a browser or extension that blocks trackers may do the trick. Firefox, DuckDuckGo, Brave and Safari all come with tracker-blocking tech.

(COMMENT, BELOW)