Messaging Apps & Platforms: Comparative Analysis

(1)

Messaging Apps & Platforms:

Comparative Analysis

January 2021

(2)

Users’ concerns about their privacy in messaging apps have spiked in recent years. Incidents of data breaches have alarmed many customers and forced them to rethink their attitude towards messaging apps and the security of their personal information. Some situations have steadily deteriorated public trust and resulted in many users wondering if they have lost control over their own data.

Users of messaging apps and platforms report being concerned about businesses and advertisers accessing and using their data. These growing privacy concerns have prompted advocacy for tighter regulations. In addition, they have placed companies responsible for safeguarding personal data under greater scrutiny.

Deep Knowledge Analytics made its own independent study to

(3)

Deep Knowledge Analytics

Introduction

3

Messaging apps are essential for our everyday activities including business communication, personal communication, and other domains. For some speciﬁc spheres such as journalism and protest activities secure messaging is one of the main issues.

The development of Information technology (IT) brought numerous advancements to messaging apps. Once suitable only for exchanging texts, most of them now allow voice messaging, voice calls, video calls, and numerous other features. At the same time, the cases associated with Edward Snowden, Pavel Durov, Cambridge Analytica have eroded the public trust in secure and private messaging by revealing the facts of surveillance of private information from the social networks and messengers by governments and third parties. This created a backlash, with the appearance of security-focused apps which offer privacy as their main advantage. Nevertheless, with more attention to privacy, users still care about the convenience and price of the messengers.

For this study, we aim to scrutinize the most popular messengers to ﬁnd out which of them combine the best user experience with the most robust security and privacy. The study separately assesses the most secure and the most convenient messaging apps, as well as the messaging apps harmoniously combining these qualities.

(4)

Methodology of the Assessment

This study by Deep Knowledge Analytics (DKA) compares 17 messaging apps and tools according to 16 variables, to ﬁnd the most secure, versatile, and accessible apps currently available. The variables were grouped into separate categories: Security, Features, and Price.

The Security category includes such variables as Peer-to-peer

architecture, end-to-end encryption systems, blockchain technology, anonymity (e.g. does the app require the phone number?), open source platform, transparency report, and independence from big companies, independence from lobbies. The features category consists of such variables as the Desktop version, Individual calls, Group audio calls, Group video calls, Screen sharing, Unsend message function, and 3d party access. The Price is coded as a separate category displaying whether the app is free, paid, or free but with some of the features requiring payment or subscription.

The score for each variable is coded as 1 if the variable condition is present or true for this app, 0 if the variable condition is absent or false or 0.5 if some features are accessible only in the paid version or if they have to be activated additionally. The Total Score is an average score of Score by Features, Score by Security, and Price. The report also provides separate Score by Features and Score by Security. The assessment is based on the database compiled for the purpose of this study from the open sources.

Total Score

Score by Features

● Desktop version ● Individual calls ● Group audio calls ● Group video calls ● Screen sharing ● Unsend message function ● 3d party access

Score by Security

● Peer-to-peer (P2P) ● E2E Encryption ● Blockchain technology ● Anonymity

● Open Source platform ● Transparency report ● Independence from big

companies

● Independence from lobbies

(5)

(6)

Features Parameters

Desktop Version Individual Calls Group Audio Calls Group Video Calls Screen Sharing Unsend Message

Function 3d Party Access Features

Jabber/XMPP 1 1 1 1 1 1 1 1 Discord 1 1 1 1 1 1 1 1 Tox 1 1 1 0 1 1 1 0.86 Signal 1 1 1 1 0 1 1 0.86 Facebook 1 1 1 1 1 1 0 0.86 Rocket.Chat 1 1 1 1 1 0 1 0.86 Wire 1 1 1 0 1 1 1 0.86 RingChat 1 1 1 0 1 N/A 1 0.83 Element 1 1 1 1 0 N/A 1 0.83 Viber 1 1 1 1 1 0.5 0 0.79 Wickr 1 1 0.5 0.5 0.5 1 1 0.79 Telegram 1 1 1 0 0 1 1 0.71 Pryvate 1 1 1 0 0 1 1 0.71 WhatsApp 1 1 1 1 0 1 0 0.71 Threema 0 1 1 0 0 0 1 0.43 Session 1 0 0 0 0 N/A 1 0.33 Briar 0 0 0 0 0 N/A 1 0.17

1

0

(7)

(8)

Security Parameters

P2P E2EE Blockchain Phone Number

Is Not Required Open Source

Provide a Transparency Report No Big Corporation Behind Zero Inﬂuencer Endorsement Security Tox 1 1 0 1 1 0 1 1 0.75 Element 1 1 0 1 1 0 1 1 0.75 Pryvate 1 1 0 1 1 0 1 1 0.75 Threema 0.5 1 0 0.5 1 1 1 1 0.75 Session 0 1 1 1 1 0 1 1 0.75 Briar 1 1 0 1 1 0 1 1 0.75 Rocket.Chat 0 0.5 0 1 1 1 1 1 0.69 Wickr 1 1 0.5 0.5 0 1 1 0 0.63 Telegram 1 1 1 0 1 0 1 0 0.63 Signal 0.5 1 0 0 1 1 1 0 0.56 Wire 0 1 0 1 1 1 0.5 0 0.56 Jabber/XMPP 0 1 0 1 1 0 0 1 0.5 RingChat 0 0.5 0 0 1 0 1 1 0.44 Discord 0 0 0 0 1 1 0 1 0.38 Facebook 0.5 0.5 0 0.5 0 1 0 0 0.31 WhatsApp 0 1 0 0 0 1 0 0 0.25 Viber 0 0.5 0 0 0 0 0 1 0.19

1

0

(9)

(10)

Total score

Features Security Price Total Score

Tox (Antox/Qtox) _0.86 _0.75 ₁ _0.87

Signal _0.86 _0.56 ₁ _0.81

Telegram 0.71 0.63 1 0.78

RingChat _0.83 _0.44 ₁ _0.76

Facebook _0.86 _0.31 ₁ _0.72

Element (riot matrix) 0.83 0.75 0.5 0.69

Session _0.33 _0.75 ₁ _0.69 Rocket.Chat _0.86 _0.69 _0.5 _0.68 Jabber/XMPP 1 0.5 0.5 0.67 Viber _0.79 _0.19 ₁ _0.66 Pryvate 0.71 0.75 0.5 0.65 WhatsApp 0.71 0.25 1 0.65 Briar _0.17 _0.75 ₁ _0.64 Wickr _0.79 _0.63 _0.5 _0.64 Discord 1 0.38 0.5 0.63 Threema _0.43 _0.75 _0.5 _0.56 Wire _0.86 _0.56 ₀ _0.47

1

0

(11)

Trade-offs between Features and Security

11

The analysis demonstrates that the majority of the messengers

cannot provide both convenience and security. This inability results

from the mutually exclusive strategies they use.

One of these parameters is the ﬁle storage. Messengers provide centralised or decentralised (P2P) cloud storage solutions. The second ones are considered to be more secure: instead of storing data on centralized servers that can be hacked, these store multiple instances of data on the drives of a decentralized network of other users. Moreover, without a centralized server, there is no single point of failure for P2P systems. There is no one server that can suffer a catastrophic failure, accidentally burn to the ground, or be seized by a third party. Data is stored on the disks of multiple (possibly even hundreds of) people, who may be located all over the world. As demonstrated by the success of the P2P BitTorrent protocol, this makes P2P systems almost impossible to censor, block, or shut down, as there is no central organization which can be pressured or coerced. At the same time, it causes a potential disadvantage of exposing IP address to the remote calling peer. Worth noting that while P2P networks can offer good performance in terms of throughput, this can come at a cost of latency, due to the fact that ﬁle pieces must often be retrieved from the other side of the world — and possibly even over dial-up connections — at substantial performance cost.

A centralized system, on the other hand, allows developers to design systems for maximum performance and provides a level of predictability that is simply not possible with a decentralized system in which a huge number of variables (such as the distance between users, each peer’s connection speeds, and device capabilities) are outside of anyone’s control. Besides a centralized system offers many useful features that users of traditional storage platforms take for granted that are very diﬃcult, if not impossible, to implement using a P2P model.

Source: ProtonMail

Centralized server Peer-to-peer network

(12)

Security

Features

Tox (Antox/Qtox) Signal Telegram RingChat Facebook

Element (riot matrix) Session Rocket.Chat Jabber/XMPP Viber Pryvate WhatsApp Briar Wickr Discord Threema Wire

(13)

The analysis demonstrated that only few messengers score high on both features and security. Moreover, the apps, which are both secure and convenient (as Tox, Element, Rocket.Chat), rarely become mainstream apps (as Facebook Messenger, WhatsApp)

In terms of the Features-Security ratio, there’s no match for Tox. Tox is aimed at users with high-security needs, worried about spying and censorship. Everything that passes through Tox is encrypted at both ends with open-source libraries. The program has no central servers that can be raided, shut down or made to hand over data. But it’s also a pretty effective instant messaging app in its own right.

Signal and Telegram are decent platforms. Signal is designed with security and data protection in mind, but since it’s a US service, it is subject to the CLOUD Act, and it requires users to disclose personally identiﬁable information.

Telegram is a cloud solution and cannot be considered “completely

secure”: Not only are messages not end-to-end encrypted by default, they are permanently stored on a server, where the service provider (or hackers) could read them at any time.

Messenger enables opt-in end-to-end encryption for speciﬁc

person-to-person Messenger chats (only secret conversations), not for groups and not by default. Implies that messages which are not “secret” risk being accessed by more than “just you and the person you’re talking to.”

Conversations in Session are secured using client-side E2E encryption. Only the sender and the recipient of a message can read it. Once Session is completed and fully developed, it should be super secure, extremely private, anonymous, and generally excellent. However, the product isn’t there yet. The Onion request system is not yet functional, causing Session to use proxy servers as workarounds.

Viber protects users’ data from hacking by default. However, users

should take extra security measures with self-customization. Negative reviews about Viber’s vulnerability are usually associated with not taking advantage of Viber’s protection features. It’s probably a good idea to periodically check the privacy settings in order to feel secure while using Viber.

WhatsApp does apply end-to-end encryption; however, user data can

be used for marketing purposes according to the privacy policy, the service is not GDPR-compliant, and requires both personal data and address-book access.

Wire received heavy criticism in 2016 for several security issues.

While Wire seems to have recovered from most of its security scares, the app still hasn’t gained the conﬁdence of users.

Overall, analysis demonstrates, that despite several advancements in technologies and security of the apps, there are no 100% secure messaging apps, even though there are several decent options.

13

(14)

DISCLAIMER

The information and analysis provided in this document were prepared by Deep Knowledge Analytics (DKA). The sources of information contained herein are deemed reliable by DKA, however, DKA makes no representations regarding to the accuracy or completeness of such information. Though the information herein is believed to be reliable and has been obtained from public sources believed to be reliable, we make no representation as to its accuracy or completeness. Hyperlinks to third-party websites in this report are provided for reader convenience only. Opinions, estimates and analyses in this report reﬂect the opinions of DKA as of the date of this report. DKA has no obligation to update, modify or amend this report or to otherwise notify readers in the event that any topic, opinion, estimate, forecast or analysis set forth herein changes or subsequently becomes inaccurate. This report is provided for informational purposes only, it may contain errors and is subject to revision.

Messaging Apps & Platforms: Comparative Analysis