Which begs the question, in what direction is the causation? Are less secure apps more popular because they're a better user experience? Are popular apps less likely to be secure because they're owned by large companies less inclined to give up precious access to information? A bit of both? Or something else entirely? Answering this question is the first step to making truly secure communication actually USED in day to day life.

I think it's a question of focus. The more secure apps are a product of focus on security. The less secure ones are a product of focus on marketing and user experience.

That's why we view this Scorecard as the opening in a campaign to evaluate both the usability and security of messaging tools. Traditional cipherpunk designs are unusable by humans, and a lot more work is going to be needed to build things that can have hundreds of millions of users and be secure at the same time.