Messaging Apps for Mentoring: WhatsApp and Telegram

Your colleague has it backwards, and this is worth getting exactly right because people make safety decisions on it.

Telegram's ordinary chats, the ones you get by default and the only kind available in groups, are not end to end encrypted. Telegram's own FAQ describes them as cloud chats using client-server encryption, stored in Telegram's cloud. End to end encryption exists only in Secret Chats, which are one to one, must be started deliberately, and are device specific: Telegram states that a secret chat started on one device is available only on that device.

WhatsApp encrypts message content end to end by default, including in groups. So for the ordinary way people actually use them, WhatsApp is the more protected of the two, not the less.

There is a catch on the WhatsApp side that matters more for this group than the encryption does. The chat backup that goes to Google Drive or iCloud is not end to end encrypted unless the user turns that on. Somebody with access to the linked account can reach the backup even though they cannot read the live messages.

The backup point is the one that worries me. Several women I work with share a phone or a cloud account with a husband or a brother.

Then encryption is not the question at all, and it is worth saying so plainly. When the device is shared, the person you are worried about is already past every lock. No app setting fixes that.

What helps in that situation is different in kind. Ask which channel is safe for her rather than announcing which one your service uses. Agree what a message from you may say, so that a notification on a lock screen gives nothing away, and agree a neutral name to be saved under. Do not send anything that would be damaging if read aloud. Keep the sensitive part for the call.

Two things worth knowing so you do not overpromise. Encrypting content is not the same as hiding that a conversation happened: who messaged whom and when is visible in ways the content is not. And if she does turn on the encrypted backup, losing the password means losing the backup, so mention that before she sets one.

Worth adding for anyone planning around apps: two of the women I work with have no smartphone. One has a basic handset, one shares her daughter's phone in the evenings. Everything in this thread assumes a device that is hers and always with her, and for them none of it applies. Plain text messages and a fixed call time are what we use.