How Secure Are Messaging Apps? Loki's Simon Harman on Privacy and Blockchain

Worries about censorship, privacy and a rising volume of cyber threats have pushed organisations to add safeguards that make their communication platforms more private and secure. Some users are going further and turning to blockchain technology to avoid depending on centralised organisations and protocols altogether, so that they keep more control over their own data.

Cyber Security Asia spoke briefly to Simon Harman, co-founder and project lead at Loki, about the growing use of messaging apps, the ways their users have been hit by malware and hacking, and whether blockchain can add a layer of privacy and encryption to the data people exchange.

Harman has worked intensively in the blockchain sector since 2015, before moving into blockchain development. His wide range of skills and his adaptability made him an influential figure in the cryptocurrency community. Regarded as a thought leader and blockchain specialist, he helped redesign and run Talk & Trade, a weekly discussion of current events in blockchain and crypto held at the Blockchain Centre in Melbourne, where he helped start-ups learn about blockchain technology and what it could be used for.

Awareness is rising, understanding is not

Asked for his view of the state of cybersecurity and how blockchain might strengthen it, Harman said that although the public is growing more conscious of why security and privacy matter, most internet users, government officials and corporate executives still do not grasp how digital security basically works. Complacency and poor understanding are common. Blockchain will not fix that on its own, in his view, but it is one of several tools that can reduce people's dependence on central authorities when they are online.

How messaging accounts are compromised

On the question of how users of messaging apps have fallen victim to malware and hacks, Harman described messaging as the successor to email, which has been heavily abused from the start. The new communication tools, he said, are fast turning into some of the largest stores of information anywhere. To take over someone's account, an attacker needs only the person's full name, date of birth and address. With those, a would-be hacker can place a fraudulent call to the victim's phone provider and effectively take control of the phone number through what Harman called "SIM splitting". SMS then gives the attacker a route into many accounts and pieces of information that are supposed to be secure. Against a determined attacker, he said, SMS and email offer weak protection for accounts.

He also pointed to a threat from inside. If an employee at a big technology company is compromised or acts in bad faith, often very little prevents them from collecting account data for their own ends, even at the most secure messaging services. Each of these services probably holds a full record of who spoke to whom and when, a dataset Harman described as enormously valuable.

What enterprises should do

For enterprise users trying to protect their messages and transactions, Harman recommended public key cryptography. RSA keys already provide some of this, he said, but far more could be done to protect user data. Companies should be much readier to delete old records and keep them offline. He credited Europe's GDPR with setting sound standards here, and added that enterprises also need better arrangements to limit how much power any single person can exercise over corporate systems.

Where Loki uses a blockchain

Asked what makes blockchain-based messaging more secure than the encryption already in use, Harman was direct: blockchain cannot easily be used to make messaging more secure. What Loki does instead is use its own blockchain to govern and record the state of its distributed network of messaging servers. This self-regulating network spreads the control of, and responsibility for, routing and storing messages. As a result, he said, no individual can ever collect enough information to know where messages are going or who sent them. Users do not have to expose their IP address when they use the system, so outsiders cannot learn their physical location. Message history is not kept long term; everything about a user's messages is stored on their own device, where they can delete it and manage it as they choose.

Harman described Loki as an application of some of the strongest privacy technologies currently available, intended for governments, companies and individuals who need to handle sensitive matters online. By offering a secure, private channel for transactions, communication and internet access, he said, Loki gives companies a free and open tool for moving money, negotiating confidential agreements, exchanging intellectual property, handling internal disputes and other critical business dealings in a secure setting.