See discussions, stats, and author profiles for this publication at: https://www.researchgate.net/publication/334537058 A Comparison of Chat Applications in Terms of Security and Privacy Conference Paper · July 2019 CITATION READS 1 1,071 3 authors: Johnny Botha Carien van 't Wout Council for Scientific and Industrial Research, South Africa Council for Scientific and Industrial Research, South Africa 8 PUBLICATIONS 19 CITATIONS 9 PUBLICATIONS 1 CITATION SEE PROFILE SEE PROFILE Louise Leenen University of the Western Cape 57 PUBLICATIONS 302 CITATIONS SEE PROFILE Some of the authors of this publication are also working on these related projects: Network Threats View project Ant Colony Induced Decision Trees for Intrusion Detection View project All content following this page was uploaded by Johnny Botha on 18 July 2019. The user has requested enhancement of the downloaded file. A Comparison of Chat Applications in Terms of Security and Privacy J. Botha1, C. Van ‘t Wout1, L. Leenen2 1Council for Scientific and Industrial Research (CSIR), Pretoria, South Africa 2 University of the Western Cape [email protected] 1 [email protected] 2 [email protected] Abstract: Mobile messaging or chat Applications (Apps) have gained increasing popularity over the past decade. Large amounts of data are being transmitted over the internet when people make use of these Apps. Metadata and personal information are being collected and stored every day while consumers are seeking protection against surveillance as well as against attacks from hackers. There are countless Apps available but some are leading the way in popularity, platform availability and features. WhatsApp, one of the leading Apps, revealed in 2016 that it had more than one billion users. In March 2016, WikiLeaks released information that the CIA was able to bypass all security systems of both WhatsApp and Signal, another popular App, to read user messages. WikiLeaks also revealed that the CIA makes use of malware and hacking tools that allow them to remotely hack into smartphones. In 2017, a Guardian report indicated that Facebook, WhatsApp’s parent company, could read encrypted messages due to a certain vulnerability found in the App. In terms of security, it is important to distinguish pure secure messaging Apps from the ones who are less secure and trustworthy. This paper compares the best and the supposedly most secure messaging Apps based on the built-in security and privacy features of the Apps, as well as the location and subsequent accessibility of stored data. Recommendations and best practice advisements for users are made on which Apps seem to be the most secure and private. Keywords: Chat app feature comparison, chat app data storage security, cybersecurity, message encryption, privacy 1. Introduction Every day millions of people are exchanging messages via messaging or rather chat Applications (Apps). However, users do not know what happens to the messages once they have been sent. Initially, encryption was considered to be used only by paranoid users or people with a heightened need for secrecy. After the revelations of Edward Snowden, consumers have become more aware of online privacy and the dangers of digital scooping of data and identity theft. Surveillance activities are increasing globally and concerns amongst people all over the world has been raised considerably whilst data retention laws are being implemented (Ali, 2017). We live in a digital age where surveillance and data logging occur on almost all our communication. Companies want to collect as much as possible personal information about consumers. Some governments are hacking mobile devices to gain unauthorised access for surveillance and other unknown reasons (Curran, 2018). Recently, the Russian government requested the chat Application Telegram, on several occasions, to give them the encryption keys of citizens registered on the chat Application. Although Telegram did not comply, they are now at risk of being banned in Russia (Caffo, 2018). Although messaging Apps have been around for a number of years, the development of secure mobile Apps are increasing, focusing on securing the privacy of users and meeting their demands (Corpuz, 2017; Das, 2017). Recent studies show that users are becoming concerned about protecting privacy on their smartphones and opposed apps that collected their contacts (Balebako et al., 2013). One survey of 2, 245 US adults showed that 57% of all smartphone app users have either deleted an app or refused to install an app for security and privacy reasons (Boyles et al. 2012). This paper covers an overview of the most secure Apps of 2017 and 2018 and also highlight some known security flaws within messaging Apps in Section 2. The main focus is a comparison of these Apps in terms of security and privacy. Section 3 presents a comparison of some of the main security features on a number of the most used messaging Apps. Section 4 provides a comparison of where messaging data and media of Apps are stored and can subsequently be accessed or recovered from. In addition, recommendations are given, in section 5, on the most secure Apps to use as well as best practices for back-ups. The paper concludes in section 7. 2. An Overview of the Best and Most Secure Messaging Apps This section gives an overview of the Apps that are regarded to be the best and the most secure; Facebook, WhatsApp, Telegram, Signal, WeChat, Line, Skype and Viber (Caffo, 2018). Two of the main reasons why chat Applications have become so popular at a rapid pace, are firstly, the rapid growth in access to cell-phones and to the Internet. Secondly the death of SMS messages because chat Applications allow for “richer” methods of remote communication. Facebook’s chat Application is called Messenger. This App is used by over two billion users registered on Facebook. The App can be accessed via Facebook and allows for normal chat messages, voice and video calls. End-to-end encryption is not enabled by default and has to be enabled with each and every chat by selecting the Secret Conversation option when messaging a contact. WhatsApp (WhatsApp, 2019) has a simple installation and setup by synchronising contacts on your phone automatically. It allows for text and multimedia messages with end-to-end encryption by default. It also periodically asks for a password to access the App. WhatsApp is owned by Facebook and there are rumours that Facebook intends to populate members’ Facebook profiles with their WhatsApp data. This idea has been blocked by the European Union, but it seems it is only a matter of time before this feature might be built in, posing more security and privacy risks to users (Caffo, 2018). WhatsApp is the most popular messaging App (Sutikno et al., 2016). Telegram (Telegram, 2019) was launched after the Snowden revelations for user that are aware of the need for secure digital communication. It offers a client-server encryption for chat messages and secret chats where privacy cannot be violated. These chats self-destruct after a certain time on the devices at both ends (for both individual or group chats) as well as on the server. Signal is developed by a company called Open Whisper Systems. Edward Snowden stated that this company can be trusted: “Use anything by Open Whisper Systems”. The App uses military-level end-to-end encryption. Signal is strengthened by an open-source platform, which is closely monitored and reviewed to improve security. It is the preferred App for hacktivists and leading security experts (Signal, 2019). WeChat has more than 700 million users and dominates the Chinese web. The App offers text messages, voice and video calls, group chats and a rich multimedia experience. It also offers features such as “Friend Radar”, “People Nearby” and “Shake” to find new people online. It was one of the first Apps that was available on Android Wear and Apple Watch. It does not offer end-to-end encryption, but it does provide client-to-server and server-to-client protection. The App has an accreditation from the Privacy company TRUSTe, who provides solutions to manage privacy compliance for the General Data Protection Regulation (GDPR) and other global privacy regulations (TRUSTe, 2019). WeChat also complies with ISO 270001-2013, a very strict international standard, therefore it would be very difficult for hackers to breach the Application (Caffo, 2018). Line is a Japanese App with more than 600 million users globally. Line offers additional features such as group chats and calls of up to 200 participants and allows calling of mobile and landline numbers via purchased credits. It also follows certain channels, news feeds and events. Skype was recently revamped in an attempt to make it more attractive to users. It is still known for its great audio and video capabilities and is used more by corporate users. Digital communication is secured by Transport Layer Security (TLS) and Advanced Encryption Standard (AES) encryption; however, there is no encryption when calling landline or mobile numbers (Websecurity.symantic.com, 2019). Viber has similar features to WhatsApp by using a mobile number to login and syncing contacts on the phone book of the device (Caffo, 2018; Viber, 2019). Table 1 provides a summarised comparison of these Apps in terms of security and privacy features. According to the Amnesty International report of 2016, Snapchat ranked among the least secure Apps because it fails with respect to privacy by not implementing end-to-end encryption (Williams, 2016). In 2019, Snapchat announced that end-to-end encryption has been added to protect user’s messages (Titcomb, 2019). 3. Comparing Security and Privacy Features Since consumers demand better security and privacy in messaging Apps, software development companies have been attempting to address these issues. One of the features was to launch end-to end-encryption (see Figure 1).