3

It seems that when it comes to mobile apps convenience defeats security - always.

In particular all messaging/communication apps seem to require to have access to your contacts on the phone and your actual phone number (like WhatsApp).

The idea is that you do not have to register nor do you have to manually add contacts to the app - all will be done automatically by the app using your contacts (presumably using their phone number and/or emails) and your phone number (as a unique id).

There is however big security/privacy difference between the app doing it automatically for you, without your control, vs you doing it manually (choosing a username tied to a specific email - not necessarily at all to your phone number), and then you choosing specifically which contacts to add to the app's address book.

Even supposedly privacy-respecting and secure apps like TextSecure by Open Whisper Systems use the automatic approach with phone number as unique id and auto-contacts-scanning/addition.

So, my question is 2-fold:

  1. Are there really no apps that do not use this automatic/convenience approach?
  2. How can one trust an app, even if its claiming to be end-to-end encrypted, if it has uncontrolled access to your phone book and actual phone number? Or I am being too paranoid and not understanding some security aspect of it?

One possible solution would be if the app were to use cryptographic hashes of your phone number and your contacts together with some salt and ever use/transmit only this information. But then, once again - do such apps exist, and more importantly how can one verify that this is actually all that is ever being sent? That is how can you be sure that even after updating the app, it still only ever uses the hashes of that sensitive info?

EDIT:

As was pointed out in the comments the major issue is not so much that the app has access to this information, the issue is that because it obviously uses Internet to provide communication it can then send that information (and much more) home to its server.

  • There are plenty of apps that do not use your phone number as an identifier. Skype, for instance. – Stephane Oct 15 '15 at 8:39
  • 2
    You are forgetting another issue: if an app has access to your contacts, it can also send this information back home (IIRC that is exactly what Whatsapp does). Therefore, you indeed cannot trust them. – Jan Doggen Oct 15 '15 at 9:06
  • @Stephane This is not completely true. Skype on Android for example lists contact access in one of its permission requests. – Fit Nerd Oct 15 '15 at 12:00
  • @JanDoggen Exactly! This is in fact my main concern. – Fit Nerd Oct 15 '15 at 12:02
  • 1
    I'm not sure what privacy is being violated. You include them in your stored contact list, which is synced to your phone's OS vendor. This might be where the phrase "shutting the barn door after the horse is gone" applies. – schroeder Oct 15 '15 at 22:30
3

At some level, you implicitly invest trust When you make the decision to use any system which is connected to the Internet, your implicitly trusting that system's operating system to do the 'right thing'. After all, it has full access to anything you do on that device. Likewise, when you decide to use an application on that system, you are implicitly trusting that application to do the right thing. Even if you don't use the address book and manually enter contact details, like a phone number, each time, you are trusting it doesn't send details to an unauthorised 3rd party.

The challenge is in determining what level of trust to assign to an operating system or an application. This may seem challenging, but it is really just an extension of something we do all the time and the same general guidelines can be used. We make decisions about trust every day. When you send your car for maintenance, you are trusting that the mechanic will do the 'right thing', when you visit your doctor, you are trusting they will do the right thing, each time you drive on the road, your trusting that other drivers will do the right thing. The techniques we use to determine what level of trust we assign in these activities use the same principals we should apply when making a decision about an application. In general terms, this comes down to reputation, legislation and what could be referred to as intuition.

  • Reputation. When you select a mechanic or a doctor, you might ask around and see what others think of them. You might check their reputation with a reputable industry body, accreditation authority or ask others whose opinion you trust. The same approach can be used for applications - see what the industry reviews have to say, talk to other users, review what their privacy statement is. The extent you go to will depend on a combination of how you assess the risk i.e. what is the likelihood that those who wrote the app will do the right thing and what would be the consequence to you if they don't. You will also mediate this by your own level of risk comfort or appetite - some people are very risk adverse and are uncomfortable with relatively low levels of risk, others have a greater appetite and are willing to accept more risk. One of the reasons that things like the Apple app store has been so popular is that supposedly Apple does some vetting of the apps in the store, giving you some increased confidence that at least Apple thinks the application is moderately OK. This in itself is not a guarantee, but it is a higher guarantee than you get downloading and installing an app from some random web site you know nothing about.

  • Legislation. In many cases, there is varying levels of legislative protection which might increase your level of trust. You might verify a mechanic, a doctor etc has obtained minimum levels of qualification to practice, has mandatory insurance or meets minimum legislative compliance requirements, is licensed to operate or in the case of driving, has a valid license. Sometimes, as is the case with driving, you can assume the other drivers on the road are licensed and know the road rules on the basis that law enforcement monitors the situation and has penalties for those who don't which are sufficient to minimise the risk you will come across an unlicensed driver who does not know the road rules. You have no guarantee, but you can be reasonably confident that the likelihood is low.

  • Intuition. This is your overall gut feeling. You might reject a mechanic or a doctor despite having verified they have a good reputation, have al the necessary accreditation, licenses, insurance etc, simply because you don't feel comfortable with them, don't like their manner or just feel somehow uneasy about them. Trust this intuition. The same goes with applications. You have to trust them at some level and you need to feel comfortable about that trust.

Are you being overly paranoid? Yes and no. On the whole, we probably should all be a little more paranoid. We shouldn't just download some app and start using it. We should investigate it first - find out what sort of reputation the app and the vendor have, talk to other users, check their website and look at their privacy statement and terms of use, think about the likelihood and consequences of the app doing the wrong thing. Depending on the app, there may be legislation or accreditation which may help (for example, some countries have legislation which require service providers to disclose details of security incidents, guarantees about how data is manged, shared and disposed etc. There are various associations which require their members to obey certain ethical codes in order to be a member which might have a baring on the level of trust your willing to hand over etc.

Where you may be getting a bit paranoid is in thinking about encryption and other mechanisms to try an improve your level of privacy protection. Most of these types od ideas are not vary practical and the level of inconvenience they impose is usually unacceptable (though this will depend on individual circumstances). For example, encrypting your address book is is unlikely to help. At some point, the application will need to know the decryption key in order to use the address book. Once you provide that key, the app has full access. Yes, you could encrypt every entry with a different key, but then you would have to provide a unique key to the app for every entry and you would need to remember all of those keys.

Currently, for most people, it is still too hard to easily assess an arbitrary application. This is especially true for new applications which have not yet developed any real reputation you can use. Likewise, there are as many bad, difficult to verify accreditation schemes out there as there are good ones (look at the Madison Ashely site - it had banners all over the place claiming accreditation from various security and other 'bodies' claiming it was secure and safe).

I think one of the best assessment rules is still "there is no such thing as a free lunch". Basically, if it sounds too good to be true, then it probably is. Software tends to take a lot of time to develop, which means a lot of money. People who do this are generally looking for some sort of reward. Sometimes, it can be reputation, but more often than not, it is financial. If you cannot see what the financial basis or operating model is i.e. how can they afford to do this?, then you should be suspicious that perhaps the app is making its money some other way, such as selling your data to a 3rd party. Avoid installing applications from random web sites you know nothing about, especially if the software is free. Be wary of applications which provide a service that could have questionable ethical standards - for example, any application which claims to help avoid paying a fee, provide free access to a service which you normally need to pay for, etc. If the stated objective of the app sounds a little unethical, it is likely those who created it have similar ethics (or lack of them) and you probably don't want to trust them with your data.

Privacy is not a binary proposition - it isn't a simple 'it is' or 'it isn't'. It has to be considered in context. What we really need is increased disclosure, not increased encryption. Encryption has an important role, but far more important is having sufficient information to allow us to make an informed choice. We should know what a vendor does with our data, how they collect it, who they share it with, how they store it and how/when they destroy it. Vendors need to treat our data with more respect and tell us what they are doing. With this information, we can then make the decision as to whether the convenience is warranted and within what each individual is willing to accept.

  • Thank you for your very informative answer. I certainly agree with a lot of points. Though when it comes to IT, surely it is a bit different than when going to a car mechanic or a doctor. While you cannot remove trust from the equation altogether you can certainly minimize it by ensuring proper setup (in terms of app architecture and your own device and practices). – Fit Nerd Oct 16 '15 at 8:38
  • For example, you don't really have to trust or not trust RSA, as long as you know that it's there (and properly implemented), key length is long enough, and quantum computing has not yet arrived - i.e. you know it's sound and not merely hope that it is! So why can't this be extended to the whole app usage case? Granted with proper practices on your behalf like choosing good passwords, with only giving the apps permissions that make sense, using separate accounts? – Fit Nerd Oct 16 '15 at 8:41
  • So, I guess I was wondering if nowadays it is actually possible to have a mobile messaging app where you will actually know (as opposed to hoping with some trust) what this app actually does and what it accesses and why. – Fit Nerd Oct 16 '15 at 8:44
  • In theory yes, in practice I don't think so. Theoretically, there are open source messaging apps, so you could analyse what they do and verify they are trustworthy. However, this is not practical and few have the necessary skills. I think you are still trusting in RSA and its implementations - that trust might be strong and based on good info, but it is still trust and may be misplaced (consider this weeks news about the NSA and DH, which highlights the issues of theory and implementation differences). – Tim X Oct 16 '15 at 21:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.