Safe Chat and Messaging
As an LGBTQ+ organization, you interact with many different types of people each day: your staff and volunteers, other organizations, and your members, among others. Here's how to keep your communication safe(r).
Text Messaging
Signal is free, open source, and encrypts everything by default, messages, calls, even who you're talking to. It's the safest option here, and the one we recommend for anything sensitive.
Telegram is popular, and we get why, it's free and most people are already on it. But regular Telegram chats aren't encrypted by default and are stored on Telegram's servers. If you're using it for sensitive organizing, switch that conversation to Signal. Telegram's fine for low stakes stuff, just don't treat it like it's private when it isn't.
WhatsApp is worth a mention too since a lot of people already use it. The messages themselves are encrypted, but WhatsApp logs who you talk to, how often, and from where. That's usually fine, but if the connections in your network are sensitive, Signal is the safer call.
A couple of small things worth doing: turn on disappearing messages in Signal for sensitive chats, a week is a reasonable default. And if your phone backs up to iCloud or Google Drive, your WhatsApp history may be included in that backup, and that backup isn't encrypted, check WhatsApp Settings, Chats, Chat Backup, and turn it off if you're not sure.
Use two-factor authentication for your email, see the Security section for how. Be careful with unexpected attachments or links, even from people you know, accounts get hijacked and used to send convincing phishing emails to their own contacts. If you're on a shared or public computer, always log out fully when you're done.
If you want extra privacy, ProtonMail and Tutanota are both encrypted email providers with free tiers worth considering.
Video Calls
Zoom and Google Meet are reasonable defaults, but neither is fully open source, so treat them the way you'd treat any proprietary tool: useful, not invincible. If you want an open source option, Jitsi is worth a look.
Whatever platform you use:
- Always set a meeting password and use the waiting room.
- Lock the meeting once everyone you're expecting has joined.
- Don't post meeting links publicly.
- If an unfamiliar name joins, ask them to introduce themselves, it's a light way to catch someone who shouldn't be there.
- Be cautious of AI note taking bots in meetings, if you don't recognize who added it, remove it.
Via a Website
Make sure the URL begins with HTTPS:// rather than HTTP://, and use Firefox or Chrome as your browser. HTTPS protects what you send to a site, but not the fact that you connected to it, use a VPN for that (see Security). Never handle private information in cybercafes or on public wifi in places like airports.
Information You Shouldn't Publish
Whenever you publish something online, ask yourself:
Who am I sharing this with? How much, and what kind of information, am I sharing? How many people can actually see it? Do I trust everyone who can see it?
On any public facing page, avoid posting:
- Members' faces, even in the background of a photo, without their explicit permission.
- The physical address of a meeting.
- Phone numbers.
If you administer a page, keep your own account private too, admins are often the easiest way to trace back to an organization.
Photos often carry hidden location data. If you're posting a photo taken at a meeting space or someone's home, strip the location data first, most phones let you turn this off in camera settings, or you can strip it before posting with a tool like ExifCleaner.
And never leave a phone or computer logged into personal or organizational accounts unattended.