[perspective]

Instant Messaging: Choices and Security

This is a post on the current landscape of communications applications, specifically the incredible triumph of mobile instant messaging applications. The information below attempts to outline the largest players and throw a spotlight on some lesser known alternatives. I welcome the input of other forum members, particularly those with an IT security background as I don’t purport that my information will be anything more than an enduser’s perspective.

Time to take stock: Facebook buys out Whatsapp

It turns out that this is a particularly suitable time to be writing this as the ink is just drying on a US$19 billion deal between Facebook and Whatsapp (19/2/2014), after the former had tried to acquire SnapChat in 2013 for US$3 billion. Whether Facebook's investment turns out to be a good one or not remains to be seen.

What is unique about Whatsapp?
Over in the thread about the purchase of Whatsapp by Facebook a number of forum members asked what is so good about Whatsapp. In an overcrowded market of messengers with a low barrier to entry, what brought about the meteoric rise of Whatsapp?

Anyone who uses it already knows the answer: it doesn’t place ads in its app and doesn’t include additional “services” — gaming, location services and retail. It has a cleared up interface and runs relatively smoothly. The Facebook-Whatsapp deal values each of the 450 million odd Whatsapp users at US$42 a piece and represents about a 9th of Facebook’s current market capitalisation. Needless to say, IM is where it’s at.

A Brief History of Instant Messaging

While the very first instances of instant messaging took place on the grounds of MIT in the 1960s, it was not until the advent of real-time text and IRC (1988) that the impending digital messaging revolution began to take shape. While the humble email rode to fame with early internet users, the introduction of upstart Mirabilis’ ICQ in 1996 unleashed the latent potential for instantaneous text communication (and the add-on functions) on home computers. Mirabilis was bought out two years later by AOL and over the coming years ICQ was quickly joined by AOL’s own AIM (1998), Yahoo! Messenger (1998) and Microsoft’s MSN Messenger/WLM (1999). These IMs already featured much of the functionality we know from mobile IM today. Free software such as Jabber arose to gather multiple messengers under one roof. The 2000s saw the inexorable rise of Skype (2003), Google Talk (2005) and Facebook Chat (2008).

The Advent of Mobile Messaging

We thought we were going to get mobile IM but it got us

While computer-based instant messaging thrived, the text messages on mobile phones boomed. First launched in 1993, the SMS (short mesaage service) became omnipresent and in 2008, for the first time, US mobile subscribers placed fewer phone calls than the text messages they sent. Despite their rudimentary nature, text messages can be used for many purposes such as banking. Indeed, in some African countries, SMS banking represents fully half of all customer transactions. While many people now own a computer, many more people have access to mobile phones which are, of course, cheaper, smaller and more practical. We are now approaching mobile subscriber base of 7 billion globally.

And along came IM apps

An increasingly larger portion of these phones is, of course, a “smart phone” and therefore can be installed with one of the mobile communications apps listed below. Needless to say, it is disproportionately younger people using IM extensively. Here they are roughly in order of popularity:

Today’s Big Mobile IM Players

Whatsapp (2009, US) – approx. 450 million users
WeChat (2011, China) – approx. 400 million users
Skype(2005, US)– 100s of millions of users
Apple IM(2010, US)– 100s of millions of users
LINE (2011, Japan) – approx. 350 million users
KakaoTalk(2011, Korea) – approx. 120 million users
Twitter (2006, US) – approx. 300 million active users
BBM (2010, US) – approx. 130 million users
Tango (2009, US)– approx. 150 million users
Kik (2010, US) – approx. 130 million users
Instagram M. (2009, US) – approx. 80 million active users
Facebook M. (2009, US) – a fraction of 1.2 billion users (1/10?)
SnapChat(2009, US) – approx 500 million messages a day

•figures above are intended as a general guide; please PM me errors or better data and I’ll edit it in

How does Instant Messaging Work?

Today’s networks comprise clients that connect to servers operated by the IM network vendor who use proprietary protocols that are not interoperable. All users that sign up for instant messaging are given a unique identifier (name or a number). The user then gives out the unique identifier to people that he or she wants to communicate with via the instant messaging network.

IM Security

The relentless desire for instant communication has gone hand-in-hand with uprooted lifestyles and caution was thrown to the wind with regard to security – by users and companies unlike. Users download everything and court disaster while companies neglect security to save money and simplify usability. Whatsapp brief history has been fraught with security breaches. Companies keen to make user-friendly software have ignored security in favour of functionality. Indeed, even in cases where security is an explicit concern of the companies and their clients, user friendliness often trumps security and compromises are made for convenience.

On computers there are communication options including Torchat, Zfone and Pidgin, what are the secure options for mainstream mobile platforms and do we need to worry? In light of on-going phone hacking scandals and the aforementioned purchase of Whatsapp by the famously dubious Facebook, many people will be looking to move away. An IM platform should be more secure when end-to-end encryption is used, allowing only you and the receiver to read messages. Apple’s proprietary iMessage protocol is, for example, end-to-end encrypted, however, the backups of the messages on iCloud are not and Apple has a track record of aiding the NSA in various surveillance programs. Blackberry’s BBM may just be able to profit from such government surveillance as it offers end-to-end encryption out of the box, though it is reputedly already been hacked by US/UK agencies. And that may well be the case for the encryption implemented in the apps below; still many here might agree that some security is better than none at all. So with that being said, let’s have a look at some of the current and future crop of ‘secure’ alternatives available. If not otherwise indicated they are currently free.

Some IM Alternatives

Telegram (Android, iOS)
It has the largest user base of those mentioned here but with US based servers, it is certainly not secure from scrutiny and manipulation by US government agencies. Telegram is partially open-sourced and features two types of chats: ordinary chats using client-server encryption accessible from multiple devices and secret chats using end-to-end encryption, only accessible from the two participating devices.

Xabber (Android)
Using XMPP (Extensible Messaging and Presence Protocol, previously named as Jabber), this IM app ostensibly provides strong security. It supports TOR using Orbot. It lacks some features and suffers some usability issues.

Threema costs US$2 (Android, iOS)
This Swiss built IM offering touts itself as having “seriously secure mobile messaging”. Its true end-to-end encryption sounds good but it is closed source and therefore it is not possible to ensure how the encryption is implemented. Also, Threema servers are located exclusively in Switzerland, which could conceivably cause performance issues for clients located outside Europe.

Wickr (Android, iOS)
Still in public beta, this app has gained some popularity and appears fairly stable offering good security options. Appears secure enough though I haven’t investigated much.

Heml.is (forthcoming for iPhone, Android)
This Swedish app is still in development. It looks pretty interesting though still has major issues to overcome. Keep an eye out for its release.

ChatSecure (iPhone, Android)
Despite having a pretty large user base and good feature set, this promising app has, as yet, some stability problems.

Secure IM for Windows Phone and Blackberries? Help me out here if you can; PM any info and I’ll post it here.


Some relevant links for further reading:
•http://expandedramblings.com/index.html/r...wZJifmSx8Q
•http://blogs.wsj.com/digits/2014/02/19/c...mpetitors/
•http://www.theguardian.com/technology/20...p-facebook
•http://www.forbes.com/sites/parmyolson/2...lion-baby/
•http://en.wikipedia.org/wiki/Comparison_...ng_clients
•http://allthingsd.com/20131124/we-still-...ut-norway/
•http://en.wikipedia.org/wiki/List_of_mos...plications
•http://www.itbusinessedge.com/blogs/unfi...-cool.html

[paninaro]

For WeChat, the numbers I've seen are over 1 billion users, when their (Tencent's) other network QQ is factored in. I believe WeChat and QQ networks work together since they're both from the same company.