If you want to communicate really securely, you may assume you need some government level spy training, a high tech encrypted phone, or at least a custom operating system. Nope. Not at all. It turns out the most secure communications device available to anyone, anywhere, right now is the humble iPod Touch.
No, seriously. Even if that’s not at all what Apple meant for you to do with an iPod, the fact that it is not on a cellular network yet can run so much vetted software on a relatively robust operating system makes it a perfect device for secure communication. Whether you’re a journalist communicating with a source, a friend planning a surprise party for your hacker buddy, a philandering spouse trying to hide your Ashley Madison dates, or just a generally private person who wants to keep your communications away from prying eyes, the iPod Touch is a pretty simple option for staying private. With the right software, you can message people over mobile instant-message apps or make encrypted voice calls.
All it takes is making sure that the model is Wi-Fi only, scrupulously keeping it updated, following a few vital steps to lock it down, and, finally, installing an encrypted communications app. After that, you'll be able to exchange seriously secure messages.
Phones, by design, constantly call out to the nearest (or strongest) cell towers to tell the network where to route calls and data. This, of course, leaves a paper trail, and those location records are available to any government agency with a warrant or, in the case of more authoritarian regimes, simply for the taking.
This means phone calls or text messages are not the best option for secure communication. The iPod Touch eliminates this problem because it doesn't use a SIM card or a baseband. There are no phone records associated with it, providing a significant privacy advantage over the iPhone and other phones, and making it less of a tracking device in your pocket.
And you can still exchange text and voice communication over Wi-Fi. Of course, you could also use a Wi-fi only iPad and follow these steps. You’d sacrifice the portability of the iPod, but that’s up to you.
Naturally, the iPod is within iOS’ closed ecosystem. Because of Apple’s stringent vetting of apps, it is rare to see malicious software, perhaps designed to log texts or steal data, available for download from the official app store.
The recent Hacking Team breach highlighted this: Even one of the most world's most notorious software surveillance companies had serious problems getting its spyware onto iOS devices. The company’s attacks probably worked only on jailbroken products, or in cases where Hacking Team's customer were able to physically access devices.
Another strength of iOS is security updates are available to download at the same time for all devices. Contrast this with Android, which leaves it to individual phone manufacturers to update products, creating situations where some devices receive vital security protections, others get them late, and some might not get them at all. Maintaining the latest software probably is the best way to fight off the majority of looming exploits or attack, and it is a trivial task with an iPod.
Of course, an iPod is only as secure the person using it. You’ve got to be smart about following security protocols to get the most out of the device’s features.
- Set up a strong password As you know, iOS devices come with robust hard-drive encryption, and the ability to set up a longer, stronger passcode than the default 4-digit code that’s easy to brute-force. It’s essential to set a strong passphrase to prevent someone with physical access to your device from getting into your stuff.
- Don’t Broadcast Your Data It's also important to ensure any data meant to be kept locally isn't accidentally being siphoned and stored somewhere else. This would involve turning off any automatic iCloud backup features—otherwise an attacker could simply target your archive there, either by cracking into it, as we saw with the celebrity nude hacks of 2014, or by a law enforcement agency compelling Apple to get your data that way. It would also be worth not installing any apps that have suspiciously high levels of access to your photos, contacts or anything else, as they provide another avenue for someone to get at your data.
- Use a Dedicated iPod The best iPod for secure communications would be used for nothing else but sending private messages. This way, the chance of some third party getting access to your info is minimized substantially: by not opening any emails, or browsing any dodgy websites, there is very little opportunity for an adversary to compromise the device.
So you’ve locked down your fully updated Wi-Fi-only iPad or iPod; now you need some apps to turn the music player into a secure communication device.
Since Snowden, the market has become saturated with apps promising encrypted comms, so choosing one can be a dizzying prospect. But after a lot of research I have a personal favorite, and experts agree that it’s probably the best out there.
Signal, from Open Whisper Systems, combines both encrypted instant messaging and voice calls into an easy to use package.
Signal also deploys “forward secrecy”. With many forms of encryption, such as the infamous PGP, all of your messages are encrypted to just one key. This means that if an adversary manages to compromise your one decryption key, they get access to all of your messages, ever.
Meanwhile Signal uses ephemeral keys, so if one set of messages is somehow broken into, that doesn’t necessarily mean everything you’ve ever typed will be readable by the enemy.
Oh, and Signal can be used to chat to its Android counterparts, RedPhone for voice and TextSecure for messages, but of course your recipients likely won’t be enjoying the same end-point security that you are.
With the iPod, the potential for metadata leakage already is reduced with the absence of any telecommunications capability. But it's vital to point out that the iPod is not suitable for totally anonymous communication, yet. Even the most trusted apps can provide enemies with some metadata, albeit in very certain contexts, and at the moment there is only experimental support for running ChatSecure, another messaging app that uses OTR encryption, through the anonymity network Tor on iOS devices.
It may also be worth remaining skeptical of Apple’s own iMessage, as noted by Nicolas Weaver, a senior researcher from Berkeley's International Computer Science Institute. If anonymity is your highest priority, you probably should use a slightly more technical solution for the time being.
Whenever you make a decision around security, the most important thing to consider is the adversary you face. Naturally, if you’re trying to protect your device from generally opportunistic hackers you’re going to need different safeguards than someone who is under federal surveillance or someone trying to hide naughty texts from a spouse. In the most extreme cases, an iPod Touch isn't ideal. But for the vast majority of people who want to be confident that their communications are secure, a properly handled iPod Touch is the best option for now.
