{"id":360,"date":"2021-02-11T14:57:17","date_gmt":"2021-02-11T17:57:17","guid":{"rendered":"http:\/\/sites.usp.br\/ubri\/?p=360"},"modified":"2021-02-11T14:59:56","modified_gmt":"2021-02-11T17:59:56","slug":"building-auditability-into-instant-messaging-apps-for-business","status":"publish","type":"post","link":"https:\/\/sites.usp.br\/ubri\/building-auditability-into-instant-messaging-apps-for-business\/","title":{"rendered":"Building auditability into Instant Messaging Apps for Business"},"content":{"rendered":"

 <\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

The ability to verify the integrity and authenticity of messages exchanged via instant messaging apps has being gaining importance lately. One of the main reasons is that such applications are being more commonly used for business purposes [1<\/a>], and it is not uncommon that the messages exchanges are somehow used as proof in legal cases [2<\/a>].<\/p>\n

A lurking danger in such scenarios, though, is the fact that most Instant Messaging apps (e.g., Telegram, WhatsApp and Signal) are designed with the specific purpose of preventing auditability: instead, they focus on plausible deniability, i.e., the security mechanisms employed deliberately fail to generate any evidence that confirm whether a given message was sent\/received by any of the communicating parties, even if that was actually the case, right after the delivery is successful. As a result, one can create forged or modified messages that are indistinguishable from the actual messages exchanged. Indeed, there are many examples in the literature of how this can be accomplished for popular apps like WhatsApp [3<\/a>] and Telegram [4<\/a>]. Therefore, and despite common believe and practice, messages willingly presented by users have little value as forensic evidence, and even less so if their contents are leaked by untrusted parties (e.g., as in the Brazilian case known as \u201cVaza Jato\u201d, roughly translated as \u201cCar Wash Leaks\u201d, were Telegram messages were obtained via mobile phone invasion [5<\/a>]).<\/p>\n

Leaving aside the (sometimes heated!) politics surrounding those cases, and aiming to address this technical issue, the goal of this research project is to create auditability features that can be easily activated and employed by users whenever they wish to trade plausible deniability for auditability, or are required to do so due to the target application\u2019s characteristics. The proposed solution combines: (1) Blockchains as the underlying data structures that regulate message exchanges among peers, so the order and integrity of those messages can be easily verified; (2) digital signatures from both sender and receiver, thus providing authenticity and non-repudiation to the message history; and (3) a mechanism for selective disclosure, meaning that a user can choose to reveal a subset of messages for the auditing party, keeping the rest of the conversation private. The different modules that constitute the solution are architecture-independent, so they can be integrated \u00a0into any instant messaging application (individually or all together).<\/p>\n

 <\/p>\n

This research project is supported by the\u00a0University Blockchain Research Initiative (UBRI)<\/a>.<\/em><\/p>\n

Contact information at USP:\u00a0Prof. Dr. Marcos A. Simplicio Jr\u00a0<\/a><mjunior(at)larc.usp.br><\/em><\/p>\n

 <\/p>\n

See also:<\/strong><\/p>\n