Author(s): Svenja Schroder, Markus Huber, David Wind, Christoph Rottermanner

Download: Paper (PDF)

Date: 12 Aug 2016

Document Type: Presentations

Associated Event: NDSS Symposium 2016

Abstract:

In this paper we analyze the security and usability of the state-of-the-art secure mobile messenger SIGNAL. In the first part of this paper we discuss the threat model current secure mobile messengers face. In the following, we conduct a user study to examine the usability of SIGNAL’s security features. Specifically, our study assesses if users are able to detect and deter man-in-the-middle attacks on the SIGNAL protocol. Our results show that the majority of users failed to correctly compare keys with their conversation partner for verification purposes due to usability problems and incomplete mental models. Hence users are very likely to fall for attacks on the essential infrastructure of today’s secure messaging apps: the central services to exchange cryptographic keys. We expect that our findings foster research into the unique usability and security challenges of state-of-theart secure mobile messengers and thus ultimately result in strong protection measures for the average user