I tried to find any documentation about the security of LINE messenger, but I couldn't.
Is there any documentation or reviews about the communication protocol it uses, and whether or not it uses end-to-end or point-to-point or no encryption?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
I'm analyzing the protocol in order to document it and make it possible to write alternate clients.
The Windows desktop versions of the client use HTTPS to talk with their servers so server communications are encrypted. Current versions verify SSL certificates properly (older versions accepted just about any certificate) and some versions seem to use certificate pinning. Some blogs indicate that other versions may be using SPDY instead of HTTPS, but that's encrypted as well. They have clients for about six platforms and they don't seem to share any code so there's bound to be other discrepancies as well.
Authentication works by means of a simple session key that is sent with the HTTP headers. The key is obtained by a login procedure which involves sending an RSA encrypted (not hashed as far as I can tell) password to the server - also over HTTPS.
There doesn't seem to be built-in support for any end-to-end encryption.
This is what I've got so far:
Most pages are in Japanese, but they do have a nice blog with the occasional english page. Altho this one isn't about security specific, it does talk about how they send messages http://tech.naver.jp