An Empirical Comparison of Security and Privacy Characteristics of Android Messaging Apps

• URL: http://arxiv.org/abs/2603.29668v1
• Date: Tue, 31 Mar 2026 12:27:28 GMT
• Title: An Empirical Comparison of Security and Privacy Characteristics of Android Messaging Apps
• Abstract summary: Mobile messaging apps are a fundamental communication infrastructure, used by billions of people every day to share information, including sensitive data.<n>Security and Privacy are thus critical concerns for such applications.<n>We present a methodology for comparing implementation characteristics of messaging applications.
• Score: 2.4890815871172736
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Mobile messaging apps are a fundamental communication infrastructure, used by billions of people every day to share information, including sensitive data. Security and Privacy are thus critical concerns for such applications. Although the cryptographic protocols prevalent in messaging apps are generally well studied, other relevant implementation characteristics of such apps, such as their software architecture, permission use, and network-related runtime behavior, have not received enough attention. In this paper, we present a methodology for comparing implementation characteristics of messaging applications by employing static and dynamic analysis under reproducible scenarios to identify discrepancies with potential security and privacy implications. We apply this methodology to study the Android clients of the Meta Messenger, Signal, and Telegram apps. Our main findings reveal discrepancies in application complexity, attack surface, and network behavior. Statically, Messenger presents the largest attack surface and the highest number of static analysis warnings, while Telegram requests the most dangerous permissions. In contrast, Signal consistently demonstrates a minimalist design with the fewest dependencies and dangerous permissions. Dynamically, these differences are reflected in network activity; Messenger is by far the most active, exhibiting persistent background communication, whereas Signal is the least active. Furthermore, our analysis shows that all applications properly adhere to the Android permission model, with no evidence of unauthorized data access.

Related papers

• From Specs to Apps: Verifying and Monitoring Models of Signal and WhatsApp [8.86750495352076]
  We develop a model of WhatsApp Web's implementation of the Signal protocol.<n>For the core components of the Signal protocol, we verify authentication and secrecy properties.<n>Monitoring reveals previously undocumented differences between the original libsignal library and WhatsApp's fork.
  arXiv  Detail & Related papers  (2026-09-10T17:48:49Z)
• TeleGapper: On the (un)reliability of Privacy Policies in Telegram Mini apps [3.345437353879255]
  Telegram Mini Apps are Web applications embedded within the Telegram client.<n>Despite their growing adoption and access to Telegram-provided context, their privacy properties remain largely unexplored.<n>We present TeleGapper, a black-box dynamic analysis framework to assess the privacy posture of Mini Apps.
  arXiv  Detail & Related papers  (2026-08-13T15:51:18Z)
• Expecting (Targeted Ads)? Network Analysis of User Health Data Leakage in Fertility Tracking Apps [9.426024604008406]
  We conduct a network-based measurement study of a corpus of 20 Android fertility tracking apps from the Google Play Store.<n>We identify explicit leakage of user health data as well implicit leakage through highly targeted contextual advertising URL's.<n>These findings provide technical grounding for widespread user concerns, but also underscore the importance of consumer choice in the privacy implications of app-based fertility tracking.
  arXiv  Detail & Related papers  (2026-06-24T18:17:04Z)
• Evaluating Language Model Reasoning about Confidential Information [95.64687778185703]
  We study whether language models exhibit contextual robustness, or the capability to adhere to context-dependent safety specifications.<n>We develop a benchmark (PasswordEval) that measures whether language models can correctly determine when a user request is authorized.<n>We find that current open- and closed-source models struggle with this seemingly simple task, and that, perhaps surprisingly, reasoning capabilities do not generally improve performance.
  arXiv  Detail & Related papers  (2025-08-27T15:39:46Z)
• Large AI Model-Enabled Secure Communications in Low-Altitude Wireless Networks: Concepts, Perspectives and Case Study [92.15255222408636]
  Low-altitude wireless networks (LAWNs) have the potential to revolutionize communications by supporting a range of applications.<n>We investigate some large artificial intelligence model (LAM)-enabled solutions for secure communications in LAWNs.<n>To demonstrate the practical benefits of LAMs for secure communications in LAWNs, we propose a novel LAM-based optimization framework.
  arXiv  Detail & Related papers  (2025-08-01T01:53:58Z)
• What If We Had Used a Different App? Reliable Counterfactual KPI Analysis in Wireless Systems [52.499838151272016]
  This paper addresses the problem of estimating the values of traffic that would have been obtained if a different app had been implemented by the RAN.<n>We propose a conformal-prediction-based counterfactual analysis method for wireless systems.
  arXiv  Detail & Related papers  (2024-09-30T18:47:26Z)
• Beyond App Markets: Demystifying Underground Mobile App Distribution Via Telegram [23.638100691705482]
  This study provides the first comprehensive exploration of the underground mobile app ecosystem on Telegram. Our findings reveal the significant prevalence of these apps on Telegram, with the total sum of subscription user numbers promoting these apps equivalent to 1% of Telegram's user base. Our analysis also exposes the misuse of iOS features for app distribution and the prevalence of malicious behaviors in these apps.
  arXiv  Detail & Related papers  (2024-08-06T23:55:39Z)
• The Medium is the Message: How Secure Messaging Apps Leak Sensitive Data to Push Notification Services [9.547428690220618]
  This study investigated secure messaging apps' usage of Google's Cloud Messaging (FCM) service to send push notifications to Android devices. We analyzed 21 popular secure messaging apps from the Google Play Store to determine what personal information these apps leak in the payload of push notifications sent via FCM. None of the data we observed being leaked to FCM was specifically disclosed in those apps' privacy disclosures.
  arXiv  Detail & Related papers  (2024-07-15T10:13:30Z)
• Relational Graph Neural Networks for Fraud Detection in a Super-App environment [53.561797148529664]
  We propose a framework of relational graph convolutional networks methods for fraudulent behaviour prevention in the financial services of a Super-App. We use an interpretability algorithm for graph neural networks to determine the most important relations to the classification task of the users. Our results show that there is an added value when considering models that take advantage of the alternative data of the Super-App and the interactions found in their high connectivity.
  arXiv  Detail & Related papers  (2021-07-29T00:02:06Z)
• Emerging App Issue Identification via Online Joint Sentiment-Topic Tracing [66.57888248681303]
  We propose a novel emerging issue detection approach named MERIT. Based on the AOBST model, we infer the topics negatively reflected in user reviews for one app version. Experiments on popular apps from Google Play and Apple's App Store demonstrate the effectiveness of MERIT.
  arXiv  Detail & Related papers  (2020-08-23T06:34:05Z)
• Mind the GAP: Security & Privacy Risks of Contact Tracing Apps [75.7995398006171]
  Google and Apple have jointly provided an API for exposure notification in order to implement decentralized contract tracing apps using Bluetooth Low Energy. We demonstrate that in real-world scenarios the GAP design is vulnerable to (i) profiling and possibly de-anonymizing persons, and (ii) relay-based wormhole attacks that basically can generate fake contacts.
  arXiv  Detail & Related papers  (2020-06-10T16:05:05Z)
• Privacy Guidelines for Contact Tracing Applications [19.094312133714023]
  We discuss the scenarios which a contact tracing application should be able to handle. We describe the various threat actors who can disrupt its working, or misuse end user's data. We present privacy guidelines for contact tracing applications from different stakeholder's perspective.
  arXiv  Detail & Related papers  (2020-04-28T06:44:14Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.