How to ensure the safe use of the messenger. Analysis

The issue of messenger security is relevant for all their users. Applications have special requirements for privacy, data collection, and other security settings. Therefore, the new features introduced in messengers also take special care of data security. For example, MAX will have a digital ID — an analog of personal documents, and first of all it is focused on security and prevention of malicious access. How to determine that a communication platform is secure and what it depends on is in the Izvestia article.

Number of permissions

• Usually, most of the complaints about a particular mobile application are related to granting it permissions from the device owner. Users are often confused by the fact that an application that was downloaded for a specific purpose suddenly asks for access to functions that will not be related to this purpose in any way. This does not take into account that such permissions can help the application work more efficiently and provide the developer with the feedback needed to improve the product.

Chat initiative: national messenger MAX has teamed up with Russia's largest AI bot

What opportunities did GigaChat 2.0 users get and why does the audience need it?

• At the same time, as noted in the analysis conducted by Kaspersky Lab, it is not always obvious to the user exactly why the messenger needs this or that access and, more importantly, what happens to the data that this messenger has access to (especially if attackers seize control of the application). Meanwhile, unnecessary accesses can pose a threat not only to privacy, but also to the security of the entire device. To minimize these risks, you should follow the rules for controlling permits.

• Adhere to the principle of a minimum number of given permissions
• Grant limited access (for example, to a photo gallery) instead of full access.
• Periodically check the issued permissions and revoke unnecessary ones.

• After the appearance of the MAX messenger, around which a large number of rumors related to data security are spreading, users began to monitor exactly what the application requires access to. Permissions to use the camera, microphone, contacts, files, Bluetooth, and geolocation were linked to the possible installation of surveillance. However, a technical analysis of this and other applications of the same class shows that all messengers request almost the same permissions from their customers. Specifically, MAX asks the user for 55 permissions, which is much less than WeChat (94 permissions), WhatsApp (owned by Meta, a company recognized as extremist and banned in Russia), which requests 81 permissions, and Telegram (72).

Confidentiality of permissions

• It should be borne in mind that not every access permission poses any threat to the user and can lead to data leakage or other unpleasant consequences. Developers usually rate them by their level of criticality, assigning a rank from the first to the fourth, where the first level of criticality is high and can lead to a violation of privacy, and the fourth indicates the absence of a threat or even contributes to the protection of the user.

• If we compare common messengers with each other, it turns out that MAX remains behind its competitors in terms of the number of first-level permissions. He had 11 of them, which is less than Telegram (18), WeChat (14) and WhatsApp (12). Analysts note that of the 145 unique permissions identified by these messengers, only 24 were assigned the first level of criticality, meaning the vast majority of permissions are not dangerous.

• It should be remembered that messengers sometimes have unique permissions that are not typical for others. They usually arouse special suspicions, and developers use them to judge what further use may lead to. For example, WhatsApp requires the user to access SMS messages, which can lead to leakage of passwords and other information provided through this channel. Telegram requests the user's location even in the background, billing information, and call initialization. The MAX has a permission option that allows you to unlock the screen without using a PIN, a graphic key, or a password. However, this feature can be intentionally disabled, which eliminates the possibility of data leakage through it. If we take into account the broader picture, then the messengers WeChat, WhatsApp and Telegram pose a much greater threat of personal data leakage than MAX.

• In August, MAX users discussed the topic that the messenger allegedly activates the camera on its own, and not on a mobile phone, but in the desktop version on a personal computer. This could potentially be a serious security breach. However, this information has not been confirmed. Kaspersky anti-virus signaled the use of the camera, but it was actually its own mistake. The messenger developers assured that the camera can only be turned on if the video call function is actively used.

Security Settings

• The user's security is ensured not only by the number and nature of the permissions that he grants to the application, but also by the proactive functions of the program itself aimed at protection. Developers can, within their capabilities, add various ways to secure the user in order to ultimately become a more attractive product. At the same time, developers are introducing a digital ID, which can be used to confirm age, having many children, and other aspects. For the sake of data security, special conditions have been developed: the ID is valid only on a specific device selected by the user, and the QR code is valid for only 30 seconds.

Logged out of the chat: fraud in foreign messengers has decreased significantly

What measures have affected this and what new tricks can be expected from intruders?

• The possibilities for enhanced protection can be very wide. Developers should follow the principles of secure development and adhere to industry best practices to reduce the risks of exploiting vulnerabilities in products. In the interests of the user, they are required to implement an anti—phishing engine to signal access to suspicious sites, strengthen the fight against malicious software, and combat oversharing - the unintentional display of data that other users can see.

• The fight against fraudulent calls has become particularly relevant recently. The MAX messenger can demonstrate some advantages over its competitors in this direction. It has implemented automatic number verification to protect against intruders. Thanks to it, the user can receive information about the reputation of the number, the name of the calling company and its category.