Popular messaging apps fail EFF's security review

The organization ranked 39 digital communication tools based on security features and best practices

Some of the most widely used messaging apps in the world, including Google Hangouts, Facebook chat, Yahoo Messenger and Snapchat, flunked a best-practices security test by advocacy group the Electronic Frontier Foundation (EFF).

The organization evaluated 39 messaging products based on seven criteria it believes such tools should meet in order to ensure the privacy and security of digital communications.

The reviewed products included mobile texting apps, instant messaging clients, voice and video calling software and email services. The results were published Tuesday under the form of a Secure Messaging Scorecard.

The EFF did not perform vulnerability assessments or in-depth technical analyses of the encryption implementations in the reviewed products. Instead it judged them based on principles and features it felt are necessary to protect communications from widespread Internet surveillance by governments, which includes data collection in transit or from online service providers.

When reviewing the products, the EFF asked the following questions:

-- Does the application encrypt data in transit?

-- Is the communication encrypted with a key the provider doesn't have access to? This requires the use of encryption keys negotiated directly between user clients, also known as end-to-end encryption.

-- Can users independently verify the identity of contacts they are speaking to even if the service provider is compromised?

-- Do previous communications remain secure even if users' long-term private keys are compromised? This property, known as forward secrecy requires cryptographic implementations that use ephemeral encryption keys for every session.

-- Is the product's code for communication and encryption open to independent review?

-- Is the product's cryptographic design well documented? This requires listing the product's encryption and authentication algorithms; documenting the key generation, storage and exchange mechanisms; describing the process of revoking and changing keys; stating the protections the software aims to provide and the scenarios where it might not be secure.

-- Has the product's design and implementation been subjected to an independent security audit in the previous twelve months? An audit by a security team that is independent of the product's development team within the same organization is sufficient.

Six applications, most of them open source, met all of the EFF's requirements: CryptoCat, a Web-based instant messaging application; ChatSecure, an encrypted chat client for iPhone and Android; TextSecure, a text messaging app for Android; RedPhone, an encrypted calling app for Android and Signal, its version for iOS; Silent Text and Silent Phone, the encrypted texting and calling apps by secure communications provider Silent Circle.

There were other apps that came close, failing on just one criteria -- the annual code audit or the forward secrecy requirements. These products were Mailvelope, RetroShare, Subrosa, Jitsi, Adium and Pidgin.

Of the mass-market products, Apple's iMessage and FaceTime scored the highest, failing on only two requirements -- the availability of code for independent review and the out-of-band contact identity verification. This means they don't currently provide complete protection against sophisticated, targeted forms of surveillance, the EFF said.

Other widely used communication tools scored much worse, meeting only one or two of the seven requirements. This was the case of Google Hangouts, Facebook chat, Yahoo Messenger, Snapchat, WhatsApp, Viber, AIM, BlackBerry Messenger and several others. None of these products offer end-to-end encryption making communications through them susceptible to surveillance on the provider's side.

South African mobile social network Mxit and widely used Chinese instant messaging service QQ don't provide encryption at all, making them the least secure products of the 39 that were tested.

Join the CSO newsletter!

Error: Please check your email address.

Tags online safetyGooglesecurityencryptiondata protectionprivacyElectronic Frontier FoundationFacebookSilent CircleApple

More about AppleBlackBerryEFFElectronic Frontier FoundationFacebookFaceTimeGoogleMessengerYahoo

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place