Google Messages putting American users at risk, report claims

American government officials have urged citizens to only use encrypted apps to protect their communications from the Chinese government-backed Salt Typhoon hacker group. It's imperative that you know which apps provide end-to-end encryption and Google Messages doesn't entirely fall into the category.

Salt Typhoon has allegedly maintained access to some of the country's largest telecom companies, including AT&T and Verizon, for months, and it could be a while before the hackers are completely kicked off the system.

As has been widely reported recently, cross-platform RCS messaging isn't end-to-end encrypted, which is why iOS and Android users should consider using third-party apps like WhatsApp or Signal to text each other.

With Verizon  retiring its proprietary app and AT&T and, to some extent, Samsung planning to do the same to encourage Google Messages adoption, you'd expect more transparency from Google about which conversations are protected. However, as Daring Fireball notes, Google Messages continues to be promoted as an app with end-to-end encryption support, despite this being only partially true.

Google Messages only supports end-to-end encryption over RCS, provided the person at the other end also has a recent version of the app. The app doubles down on the claim by mentioning "Data is encrypted in transit" and "Your data is transferred over a secure connection."

Again, that's not a false assertion, but these security practices only apply when you are texting someone who also uses Google Messages.

An average user who doesn't follow tech news will take the claim for what it is and assume they are following the FBI and CISA's guidelines by using Google Messages. Even texting only other Android users might not be sufficient to protect against eavesdropping from Chinese hackers as end-to-end encryption is not available for SMS or when texting someone who uses an RCS client other the Google Messages.

Google should be more transparent about these details, instead of unintentionally keeping its users in the dark.