The Digital Security Digest, by Freedom of the Press Foundation (FPF), is a weekly newsletter with security tips that keep you, your sources, and your devices safe. If someone shared this newsletter with you, please subscribe here.

WhatsApp joins the username club

WhatsApp, owned by Meta, is the largest messaging app in the world to offer end-to-end encryption by default. But it has a meaningful privacy trade-off: You have to use your phone number to communicate with others on the app. In a blog post this week, the company said “a phone number is personal and it’s tied to so many parts of your life. Sometimes you just want to chat without handing over your digits.” That’s why it announced the rollout of usernames. Users will receive a notification when they can reserve their handle, which may be between three and 35 characters. Read more about the new feature.

What you can do

We strongly recommend that journalists enable usernames instead of using their phone numbers whenever possible. The risk of a phone number is that your sources and other sensitive contacts may put it in the app that stores their contacts. This number may be backed up to iCloud or Google Drive, where it is vulnerable to legal requests.

  • When available, set up usernames immediately. WhatsApp notes in its post that it will notify users when this feature is available in their country. When available, it will be found here:
    • iPhone users: You (at the bottom right) > “Account” > “Username”
    • Android users: Three-dot menu (top right) > “Settings” > “Account” > “Username”
  • Harden your settings. For now, you’re going to want to tinker with some settings in WhatsApp. For example, the app has a habit of repeatedly trying to get you to make backups of your end-to-end encrypted messages in plain text to iCloud or Google Drive. The word “No” is a complete sentence, WhatsApp. We have a short laundry list of things you can do to upgrade your WhatsApp security.
  • Learn more about secure communications. To learn about this and a variety of tools for end-to-end encrypted messaging, check out our guides.

Updates from our team

  • We’ve made some updates to our Spanish-language guides to locking down Signal and upgrading WhatsApp security. Check out our guías en Español.

Our team is always ready to assist journalists with digital security concerns. Reach out here, and stay safe and secure out there.

Best,
Martin

–

Martin Shelton
Deputy Director of Digital Security
Freedom of the Press Foundation