In recent months I have seen a large number of applications that are coming to light that try to solve a problem: communicating with other people, through a secure channel, preventing outsiders to the conversation from being able to read what you write.
After Snapchat and its obvious good result, many have entered the game of providing secure communication channels.
The need exists: in governments, high-profile companies, etc., but it leads me to a question: is it really safe?. It’s complicated.
#.Don’t they explain their security system? Don’t use it.
It’s that simple.
Companies that handle user data, especially when they sell security, must be as transparent to the user as possible. A typical example is LastPass, a secure hosting and password central service. That is, LastPass lives on the security of your data and therefore, their site is quite explicit about how they manage passwords, how they save them, how they communicate with the user, among many others.
Is LastPass being less secure by being transparent? Quite the opposite.
There are multiple questions that come to mind when an application tells me that I will be able to communicate with other users safely:
- How does my data travel?
- Are you traveling through a secure channel?
- What type of encryption do you use?
- How is data saved on your server?
- If they use encryption: where is the information encrypted and decrypted: on their servers or on my terminal?
- Where is your server hosted?
- Is everything centralized?
- What data does your server handle and what does not?
- Who can communicate with your server?
- Where are your facilities?
- Are your facilities and those of your server secure?
- How is the notification service managed?
- Is it necessary to use notifications, really?
- …and I could write 100 more
Trusting a company or app that isn’t transparent about how it handles your private information is trusting the word of a complete stranger.
The only thing left to say is that if your organization needs to handle sensitive data, through secure channels, such as secure private messaging, think twice about how you are going to do it. Maybe your medicine could be worse than the disease.