Secure instant messaging

Secure instant messaging is a form of instant messaging. Both terms refer to an informal means for computer users to exchange messages commonly referred to as "chats". Instant messaging can be compared to texting as opposed to making a cell phone call. In the case of messaging, it is like the short form of emailing. Secure instant messaging is a specialized form of instant messaging that along with other differences, encrypts and decrypts the contents of the messages such that only the actual users can understand them.

Instant messaging background

Instant messaging has existed in some form or another for decades. Generally, it is a process by which users on a computer network can quickly communicate with one another using short text-based sentences rather than using email. Each user has a piece of software that communicates with a common server that connects the chat sessions. Over the past few years, two distinct settings for the use of instant messaging have evolved.

The first is the corporate or institutional environment composed of many potential users but who are all under the same organizational umbrella.

The second setting is individual users "after work" or at home who do not have a mission-oriented commonality between them, but are more likely family and friends.

In the corporate setting, security risks are apparent from the outset. What stops a disgruntled employee from messaging some sensitive company data to a colleague outside the enterprise? The reverse of that would be the example disgruntled employee downloading some virus or spyware onto his machine inside the corporate firewall to release as desired. Accordingly, organizational offerings have become very sophisticated in their security and logging measures. Typically, an employee or organization member must be granted a login and suitable permissions to use the messaging system. This creating of a specific account for each user allows the organization to identify, track and record all use of their messenger system on their servers.

The specialized requirements of the organizational messaging system, however, run almost completely contrary to what an individual user may need. Typically non-organizational use instant messengers advertise their availability to the Internet at large so that others may know if that person is online. The trend has been too that manufacturers of instant messaging clients offer interoperability with other manufacturer's clients.

This competitive edge grew out of the heretofore use of proprietary communications protocols used by the client manufacturers. Compatibility between clients is likely to become almost universal, as a unified messenger protocol (the Extensible Messaging and Presence Protocol (XMPP)) is being adopted by more and more manufacturers. The XMPP has been at least in part been formalized by the Internet Engineering Task Force as RFC 6120, RFC 6121 and RFC 6122 which will further the trend towards instant messaging standardization.

For the typical social individual user this product evolution spells greater ease of use and more features.

Traits of a secure instant messenger

In November 2014, the Electronic Frontier Foundation listed seven traits that contribute to the security of instant messengers:

• Having communications encrypted in transit between all the links in the communication path.
• Having communications encrypted with keys the provider does not have access to (end-to-end encryption).
• Making it possible for users to independently verify their correspondent's identity e.g. by comparing key fingerprints.
• Having past communications secure if the encryption keys are stolen (forward secrecy).
• Having the source code open to independent review (open source).
• Having the software's security designs well-documented.
• Having a recent independent security audit.

In addition, the security of instant messengers may further be improved if they:

• Do not log or store any information regarding any message or its contents.
• Do not log or store any information regarding any session or event.
• Do not rely on a central authority for the relaying of messages (decentralized computing).

Recent news events have revealed that the NSA is not only collecting emails and IM messages but also tracking relationships between senders and receivers of those chats and emails in a process known as metadata collection. Metadata refers to the data concerned about the chat or email as opposed to contents of messages. It may be used to collect valuable information.

See also

• Table overview of secure messengers