{"id":5091,"date":"2014-11-21T11:37:26","date_gmt":"2014-11-21T16:37:26","guid":{"rendered":"http:\/\/kasperskydaily.com\/uk\/?p=5091"},"modified":"2020-02-26T15:10:39","modified_gmt":"2020-02-26T15:10:39","slug":"11_insecure_messengers","status":"publish","type":"post","link":"https:\/\/www.kaspersky.co.uk\/blog\/11_insecure_messengers\/5091\/","title":{"rendered":"11 Insecure Mobile and Internet Messaging Apps"},"content":{"rendered":"

Last week we\u00a0looked at the Electronic Frontier Foundation\u2019s secure messaging scorecard<\/a> and made a list of nine mobile and Internet messaging services<\/a> that scored well on privacy and security.\u00a0Today, we\u2019re looking at the worst.<\/p>\n

\"11-Insecure-Mobile-and-Internet-Messaging-Apps\"<\/a><\/p>\n

Interestingly, if last week\u2019s list of messengers seemed obscure, than this week\u2019s list of apps and services will seem all too familiar. For that reason, we\u2019ll focus primarily on the most popular messengers, though we\u2019ll also note the poor-scoring less popular ones\u00a0as well.<\/p>\n

Context<\/h3>\n

The EFF issued up or down grades to each service for seven categories. For Kaspersky Daily, service providers earned failing grades where they received no points in the following categories:<\/p>\n

1. Is data encrypted in transit?
\n2. Is data encrypted so that even the service provider can\u2019t read it?
\n3. Can you identify the true identity of contacts?
\n4. Does the provider practice what is known as perfect forward secrecy, meaning crypto-keys are ephemeral so a stolen key won\u2019t decrypt existing communications?
\n5. Is the service\u2019s code open-source and available for public review?
\n6. Are cryptographic implementation procedures and processes documented?
\n7. Has there been an independent security audit in the last 12 months?<\/p>\n

Altogether, the seven points are designed to measure which service offers the best protection against government surveillance, criminal snooping and corporate data collection. That said, neither the EFF nor Kaspersky Daily are officially endorsing any of the following programs. The list merely indicates which applications are consistently not following best practices.<\/p>\n

The Really Bad: Zero Checkmarks<\/h3>\n

Only the Mxit and QQ mobile messengers received zero stars, but there\u2019s a decent chance you\u2019ve never used either anyway. Of all seven categories, the fact that Mxit and QQ aren\u2019t encrypting data in transit is why we are recommending you use neither\u00a0of them, because your communications on both apps can be viewed in plain text as they travel from sender to recipient.<\/p>\n

The Still Pretty Bad: One Checkmark<\/h3>\n

Unfortunately, there are four messenger services that nearly all of us have used, that received just one of seven stars.<\/p>\n

\"Yahoo-Messenger-logo\"<\/a><\/p>\n

\u00a0<\/p>\n

Long-time encryption laggard Yahoo\u2019s messenger service only manages to encrypt user communications in transit. This means that Yahoo (the company) can read your messages or hand them over to law enforcement if they choose to do so. Despite this, they do issue biannual transparency reports<\/a> detailing how much information they grant upon government request.<\/p>\n

You also can\u2019t verify the identities of your contacts with Yahoo! Messenger, nor does it practice perfect forward secrecy, open its code to independent review, or document its security design properly. Finally, the company has not performed a recent code audit either. To be fair, Yahoo\u2019s more broad Web offerings have come a long way<\/a> from where it was two years ago in terms of encryption, so there may be hope yet for its messenger as well.<\/p>\n

\"skype-logo\"<\/a><\/p>\n

Microsoft\u2019s calling and messaging service, Skype, scored just as poorly as Yahoo! Messenger, receiving only one (and the same) check-mark for encrypting data in transit. It didn\u2019t receive a second passing mark across each of the subsequent categories. Skype has something of a patchy\u00a0record in terms of communications integrity and surveillance accusations, namely that the service has taken fire from critics for its alleged susceptibility to snooping<\/a>. Microsoft has denied these claims.<\/p>\n

\"Blackberry-Messenger-Logo\"<\/a><\/p>\n

BlackBerry Messenger received the exact same score as both Yahoo! and Skype. The service, run by the company formerly known as Research In Motion \u2013 or RIM \u2013 does encrypt communications in transit, which is good, but it does not encrypt communications so the provider (BlackBerry) can\u2019t read them, allow users to verify contacts, protect past communications in the event that your keys are stolen, open its code to independent review, properly document security design, nor has it allowed a code audit in the last year.<\/p>\n

\"AIM-Logo\"<\/a><\/p>\n

AIM, perhaps better known as American Online\u2019s Instant Messenger has been around for a long time. It\u2019s safe to say that from the late 90\u2019s through the mid-naughts, AOL\u2019s Instant Messenger was peerless. While it\u2019s popularity isn\u2019t what it used to be, particularly among the younger generation, it\u2019s still widely used. Unfortunately, like those mentioned above and below, it encrypts data in transit but doesn\u2019t do a whole lot more.<\/p>\n

For what it\u2019s worth, the cross platform Secret Message app touts itself as secure and the Hushmail email client calls itself private while each only encrypts data in transit. The Kik and eBuddy XMS platforms don\u2019t outright advertise their security posture, but they both received the same check-mark as everyone else in this category and no others.<\/p>\n

The Better but Still not Good: two checks<\/h3>\n

\"SnapchatLogo\"<\/a><\/p>\n

The popular ephemeral image and video-sharing application, SnapChat, comes in with two-stars. One for encrypting data in transit as it passes from the sender, through SnapChat\u2019s servers, to the recipient. And another star for having performed an audit in the previous year. Like many of the services on this list, SnapChat has been the subject of much criticism, not so much for lacking security, but for failing to follow through on its central premise<\/a>.<\/p>\n

The core idea behind SnapChat is that messages, photos or videos appear for an amount of time determined by the sender before disappearing forever. However, the recipient can save images by taking screen grabs, though the sender would be notified. More troubling, an application called SnapHack circumvents SnapChats ephemerality altogether, by allowing recipients to simply save Snaps. And lastly, researchers have repeatedly claimed that the images never really go away<\/a>, but merely become\u00a0more difficult to find.<\/p>\n

\"Hangouts_Icon\"<\/a><\/p>\n

Likely in the top three in terms of popularity for apps on the EFF\u2019s scorecard, Google\u2019s Hangouts<\/a> got two stars. Hangouts is cross-platform. It\u2019s not only the built-in Gmail chat client, but it\u2019s also the native chat client for Google Plus as well as for Android devices. Google encrypts data in transit for Hangouts and has had an audit in the last year, but Google can read your messages, users can\u2019t verify contacts\u2019 true identities, it doesn\u2019t deploy perfect forward secrecy, it\u2019s code is not open to independent review and its security design is not properly documented.<\/p>\n

\"FacebookMessenger\"<\/a><\/p>\n

Facebook\u2019s Chat, which is the mobile variety of the Facebook messaging service, gets two stars too. As popular as any service on the scorecard, Facebook Chat encrypts data in transit and has been audited, but fails across the other categories.<\/p>\n

\"viber-logo\"<\/a><\/p>\n

Viber is surely the least popular among the two-star category. While it\u2019s apparently known as a private messenger, it only gets checks for encrypting in transit and carrying out an audit.<\/p>\n

\"WhatsApp-Logo\"<\/a><\/p>\n

This brings us to the increasingly curious case of WhatsApp. WhatsApp is an incredibly popular mobile text messaging service. So promising is WhatsApp, the social media goliath, Faceboook, spent a cool $19 billion acquiring it earlier this year<\/a>. It\u2019s a sort of data alternative to the SMS texting protocol (as in it works over the Internet rather than over the cellular network itself). While the EFF gave the service the same two checks it gave everyone else in the two-star category, I suspect that could change.<\/p>\n

The reason for that change is that just this week, WhatsApp partnered with Open Whisper Systems<\/a> adding default encryption to its Android app. As a point of reference for why we think things could change for WhatApp given this partnership, Whisper Systems\u2019 Signal, RedPhone, SilentText and SilentPhone offerings passed on all seven checks in the EFF\u2019s score card. In other words, it appears that WhatsApp is to become considerable more secure in the coming days and months.<\/p>\n

At the moment though, the cryptography\u00a0is only implemented on Android devices for one-on-one communications. So iPhone users will have to wait and group message chains are not as secure yet. However, WhisperSystems says they are working on both of those problems as we speak.<\/p>\n

The bottom line with the WhatsApp cryptography announcement is this: That they are starting to take security and privacy very seriously is great news, and hopefully WhatsApp\u2019s competitors will follow its lead.<\/p>\n","protected":false},"excerpt":{"rendered":"

Last week we\u00a0looked at the Electronic Frontier Foundation\u2019s secure messaging scorecard and made a list of nine mobile and Internet messaging services that scored well on privacy and security.\u00a0Today, we\u2019re<\/p>\n","protected":false},"author":42,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[9],"tags":[218,43,835,97,690,744],"class_list":{"0":"post-5091","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-tips","7":"tag-mobile-security","8":"tag-privacy","9":"tag-secure-messaging","10":"tag-security-2","11":"tag-spying","12":"tag-surveillance"},"hreflang":[{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/11_insecure_messengers\/5091\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/11_insecure_messengers\/6179\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/11_insecure_messengers\/6179\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.co.uk\/blog\/tag\/privacy\/","name":"privacy"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts\/5091","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/users\/42"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/comments?post=5091"}],"version-history":[{"count":2,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts\/5091\/revisions"}],"predecessor-version":[{"id":19160,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts\/5091\/revisions\/19160"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/media?parent=5091"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/categories?post=5091"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/tags?post=5091"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}