Google will be launching its new Allo chat application in the coming weeks, and with it comes true end-to-end encryption. Open Whisper Systems has announced that its own Signal Protocol is powering the encryption in Allo. It's not on by default, which has sent some privacy purists into a fit, but this is still a very good thing.
Rolling your own encryption scheme can be risky, as Telegram has learned. The Signal Protocol is seen by many as a very secure and well designed cryptography solution. It's used by Open Whisper Systems' own Signal chat app, but also by third-parties like WhatsApp. When Allo launches, you won't get E2E encryption in the default chat mode. The Google Assistant bot needs access to what's happening to be of any use, so your conversations will only be encrypted to and from the Google server. If you switch to Incognito mode, everything is end-to-end encrypted. Only you and the other party will be able to read the messages. The Google bot won't work in this mode.
Some personalities in the security community have tried to scold Google for this approach, most notably Edward Snowden. The argument is that since your chats aren't automatically E2E encrypted, Allo is a bad app and Google should feel bad. That's one way to look at it. Another way might be that Google wanted to build in some useful features leveraging its experience in natural language processing, and the best way to do that is with a bot. However, you can skip all that and get full E2E encryption. That seems fine to me, because let's face it, no one is going to design a product where all the cool features are disabled by default.
- Open Whisper Systems