The National Security Agency (NSA) has a warning for all iPhone and Android users. It is not about the apps themselves, but about how people use them. Millions of users do not realize that simple mistakes can compromise their security. This warning came to light after a mix-up involving Trump officials and a journalist on a sensitive group chat.

The NSA's alert was sparked by a discovery from Google's Threat Intelligence Group. They found that Russia's GRU was tricking Ukrainian officials into giving access to their Signal accounts. This allowed the Russians to eavesdrop. It was not a flaw in Signal but a user error. The same risk applies to other popular apps like WhatsApp and Telegram.

The main issues are features designed to make these apps user-friendly: Linked Devices and Group Links. Linked Devices allow you to sync your messaging apps across all your devices. Group Links make it easy to add new members to a group chat with a simple link. However, these conveniences can also be gateways for attackers.

The Group Link threat is limited to the group itself and can be easily fixed. In Signal, you can disable the Group Link in the group's settings. For WhatsApp, avoid using links for sensitive groups and set them so only admins can add members. The Linked Devices feature is more risky. It can create a fully synced replica of your messaging app on another device. To mitigate this, regularly check and unlink any devices you do not recognize.

There is a catch. In the Russian attack, the Signal group invite link was hijacked to link a device instead. This was a vulnerability in the invite process, not the app itself. Regularly checking linked devices is crucial. It is also wise to unlink and relink browser web app links periodically. Be cautious about clicking group links unless you expect them and trust the sender.

The NSA also offers some common-sense advice. Set and regularly change your app PIN, enable screen lock, and do not share contact or status info, especially outside your contacts. They also suggest keeping phone and app contacts separate, although this can be inconvenient for daily use.

Secure messaging is often misunderstood. End-to-end encryption protects the transmission, but the content can still be compromised if the device is hacked, the user saves the content, or the wrong person is added to a group. No app is foolproof if other security measures are flawed or if users make mistakes.

Secure Messaging: Why Your Behavior Matters More Than You Think

Actions