When SIGNAL hits the Fan: On the Usability and Security of State-of-the-Art Secure Mobile Messaging

Abstract

In this paper we analyze the security and usability of the state-of-the-art secure mobile messenger SIGNAL. In the first part of this paper we discuss the threat model current secure mobile messengers face. In the following, we conduct a user study to examine the usability of SIGNAL's security features. Specifically, our study assesses if users are able to detect and deter man-in-the-middle attacks on the SIGNAL protocol. Our results show that the majority of users failed to correctly compare keys with their conversation partner for verification purposes due to usability problems and incomplete mental models. Hence users are very likely to fall for attacks on the essential infrastructure of today's secure messaging apps: the central services to exchange cryptographic keys. We expect that our findings foster research into the unique usability and security challenges of state-of-theart secure mobile messengers and thus ultimately result in strong protection measures for the average user.• We performed a user study with 28 participants on the usability of SIGNAL's security features, the state-ofthe-art application for secure mobile messaging.• Our results showed that 21 of 28 participants failed to Permission to freely reproduce all or part of this paper for noncommercial purposes is granted provided that copies bear this notice and the full citation on the first page. Reproduction for commercial purposes is strictly prohibited without the prior written consent of the Internet Society, the first-named author (for reproduction of an entire paper only), and the author's employer if the paper was prepared within the scope of employment.

Can Johnny build a protocol? Co-ordinating developer and user intentions for privacy-enhanced secure messaging protocols

“…High-risk users tend to be in areas where information security is important due to political instability, although wellknown activists and persecuted minorities in "stable" countries would count as high-risk users. Most usability studies over PGP, OTR, and Signal are still done with low-risk users such as college students, despite the use of secure messaging being considered to be important to high-risk users [22], [20], [19]. We would hypothesize that high-risk users have different threat models and so different requirements for privacy and secure messaging.…”

“…Encrypted messaging applications like WhatsApp, Telegram, and Signal are now the default encrypted messaging application for users that consider themselves to be high-risk. Usability studies have shown that although Signal (similar to OTR) is easy to setup and use, even highly-skilled users fail to use verification correctly [19]. Currently, the Signal Protocol is centralized, as a single server mediates the setup of the protocol in most widespread deployments (Signal, WhatsApp, Google Allo, Facebook Messenger, Wire).…”

Co-ordinating Developers and High-Risk Users of Privacy-Enhanced Secure Messaging Protocols

“…Developers do tend to verify keys, and it seems to be related to habits gained in software development. As shown by previous work, key verification is hard to both understand and use [6].…”

“…A wellknown argument in favor of centralization and against standards was published by Moxie Marlinspike (Signal core developer) in his blog. 6 This blog-post, called "The eco-system is moving," has attracted considerable attention and is widely quoted by developers as a reason not to use standards, as centralization offers better control while federation can be "dangerous" in terms of security (D11), as it is hard to audit all the different implementations of the protocol and ensure correct updates. Developers from PGP, XMPP, and other protocols (Briar, Ricochet, etc.)…”

Securing Instant Messages With Hardware-Based Cryptography and Authentication in Browser Extension

“…However, it is not always the case that security breaches are due to technical problems, but may also be due to users' lack of security awareness. Schröder et al [24] presented a study on the Signal IM application and its end-to-end encryption, and showed that the majority of the tested users were not able to identify a MitM attack taking place on the application, even with alerts popping up. The users selected for the research were computer science students and, even with the expected security background, had their privacy exposed.…”