How Secure is TextSecure?

Frosch, Tilman; Mainka, Christian; Bader, Christoph; Bergsma, Florian; Schwenk, Jörg; Holz, Thorsten

doi:10.1109/eurosp.2016.41

Cited by 43 publications

(30 citation statements)

References 32 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…They used a testbed similar to MATAdOR, but had to explicitly configure the mobile device's proxy settings. Frosch et al [7] provided a detailed protocol analysis for TextSecure based on its source code. Anthropological studies like O'Hara et al [16] mainly focus on the content of messages and their implications on social life, usually featuring small trace sets or interview data and not data generated from automated testbeds.…”

Section: Related Workmentioning

confidence: 99%

Analyzing Locality of Mobile Messaging Traffic using the MATAdOR Framework

Scheitle¹,

Wachs²,

Zirngibl³

et al. 2016

Passive and Active Measurement

View full text Add to dashboard Cite

Mobile messaging services have gained a large share in global telecommunications. Unlike conventional services like phone calls, text messages or email, they do not feature a standardized environment enabling a federated and potentially local service architecture. We present an extensive and large-scale analysis of communication patterns for four popular mobile messaging services between 28 countries and analyze the locality of communication and the resulting impact on user privacy. We show that server architectures for mobile messaging services are highly centralized in single countries. This forces messages to drastically deviate from a direct communication path, enabling hosting and transfer countries to potentially intercept and censor traffic. To conduct this work, we developed a measurement framework to analyze traffic of such mobile messaging services. It allows to conduct automated experiments with mobile messaging applications, is transparent to those applications and does not require any modifications to the applications. IntroductionMobile messaging services like WeChat or WhatsApp see a steady increase in both active users and messages sent, with a particular success in emerging markets like China, Brazil or Malaysia [18,30]. Some researchers predict a shift in communication paradigms with mobile messaging services eradicating classical forms of electronic communication like email or text messages. As an example, the number of text messages sent in Germany shrunk by 62% from 2012 to 2014 [5], after it had been growing exponentially for over a decade.Mobile messaging services and their design strongly differ from classic Internet communication services: established means of communication-like email, internet telephony or instant messaging-often rely on federated or decentralized architectures, with operators providing services to their customers and from within their domain.Mobile messaging services tend to abandon established principles of openness and federation: messaging services are often realized in a closed, non-federated, cloudcentric environment built upon proprietary communication and security protocols neither standardized nor disclosed to the public.This paradigm shift puts at risk the user's freedom and access to secure, confidential and privacy-preserving communication. With such services, the user-relating to her social network through such applications-strongly depends on the service provider to not modify or restrict the service. The user's privacy also depends on the legislation the operating company is subject to: governments are often interested in controlling Internet services [13,31] and accessing messages [8] as well as metadata. The matters of security and privacy move along the same lines and generally involve a full trust into a closed system, a misleading assumption as we saw with WhatApp's announced endto-end-encryption, which is supported on Android, but not Apple devices [1], without giving feedback on encryption status to the user. First attempts to analyze the security p...

show abstract

Section: Related Workmentioning

confidence: 99%

Analyzing Locality of Mobile Messaging Traffic using the MATAdOR Framework

Scheitle¹,

Wachs²,

Zirngibl³

et al. 2016

Passive and Active Measurement

View full text Add to dashboard Cite

show abstract

“…Apart from users' perceptions, also questions about the security of the implementations of such features arise. Messenger security, for example, with focus on their end-to-end encryption, has been well-studied and shown to have flaws [17]- [19]. A broad overview of security features in instant messaging is provided by Unger et al [20].…”

Section: Related Workmentioning

confidence: 99%

User Perception and Expectations on Deleting Instant Messages, or "What Happens If I Press This Button?"

Schnitzler¹,

Utz²,

Farke³

et al. 2018

Proceedings 3rd European Workshop on Usable Security

View full text Add to dashboard Cite

Abstract-Contemporary mobile messaging provides rich text and multimedia functionality leaving detailed trails of sensitive user information that can span long periods of time. Allowing users to manage the privacy implications both on the sender and the receiver side can help to increase confidence in the use of communication applications. Recently, in October 2017, one of the mobile messengers with the largest user base, WhatsApp, has introduced a feature to delete past messages from communication, both from the sender's and the receiver's logs.In this paper, we report on a study with 125 participants conducted in a between-subjects design. We explore the actual demand for deleting mobile messages, and we investigate how well users comprehend this functionality as implemented in popular messaging applications. We found statistically significant differences in users' understanding of message deletion between our three test conditions, comprising WhatsApp, Facebook Messenger, and Skype. 80 % of participants in the WhatsApp condition could correctly assess the effects of deleting messages, compared to only 49 % in the Skype condition.Our findings indicate that users demand a message deleting functionality and that they can more precisely estimate the capabilities of a deletion function when its effects are transparently explained in the application's user interface.

show abstract

“…It has gained considerable attention recently after being incorporated into WhatsApp [FMB+14;Ope14a]. Assuming Axolotl is used on two devices, the key material can evolve independently for each device.…”

Section: Prekeysmentioning

confidence: 99%