Let's gather some bibliography

[bumblefudge]

Maybe we can do one message per link/PDF/resource?

[bumblefudge]

Src: https://techpolicy.press/what-is-secure-an-analysis-of-popular-messaging-apps/ , hot off the presses

The full 86-page report PDF is available for download here.

Key findings and recommendations include:

1. Users are too often flying blind. Even those most concerned about privacy rarely have sufficient information to make decisions that are in their own best interest. There is a substantial gap between the promise of encryption and the reality of threats to secure messaging in practice. We encountered various forms of “security folklore” that inform user decisions in place of information grounded in fact, as well as “security nihilism,” a debilitating sense among some that there is no way to communicate securely.

2. An app’s cryptographic security doesn’t mean it is secure. Implementation is everything. The failure to implement end-to-end encryption by default, such as on Telegram and Meta’s Messenger, illustrate this point. Users may not understand the distinction when presented with confusing options like “secret chat” and “private chat.” And few users understand design distinctions, such as different colors for messages in Apple’s iMessage and Google Messages, that are intended to communicate different types of messages (SMS or encrypted,) and thus different levels of security.

3. Follow Signal’s lead and encrypt or don’t store metadata. Signal is the only app that has taken steps to hide users’ profiles, contacts, group metadata, and even message sender information. Other developers need to follow Signal’s example and hide user metadata by keeping it encrypted with the user’s account key and only handling unencrypted versions in secure enclaves.

4. Let users decide which features should be on or off. Companies need to allow for any feature that impacts privacy and security to be turned on and off, and to explore and implement more granular settings that allow for users, especially high-risk users, to tailor the service to their needs, including when it comes to disappearing messages, link previews, storing and deleting call logs, and interaction history.

5. Close technical and design ‘loopholes’ that betray privacy. From unencrypted backups of messages and the use of phone numbers as identifiers to flaws in how deleted messages are handled, confusing naming conventions for certain features, and bad user design on some options, there are a range of technical and design issues that the makers of messaging apps need to address urgently.

6. Beware the bloat. Especially when it comes to apps that are connected to or are trying to emulate some aspects of social media platforms, including Meta’s Messenger, Telegram and increasingly WhatsApp, there is evidence of feature bloat and connections to other apps and services that may create new privacy concerns. The incentives of surveillance capitalism are privacy and safety’s worst enemy, particularly when developers deploy deceptive design patterns.

7. Encryption must be defended. Governments around the world–including in democracies–are threatening encryption with a range of new regulations and laws that will effectively break the model of apps like Signal and WhatsApp. It is crucial that policymakers, industry voices, and activists that understand the value of encryption speak up in its defense.

This research, conducted by Convocation Research & Design and Tech Policy Press, was supported with funding from a program at Omidyar Network focused on private and trustworthy messaging.

[depatchedmode]

Digital Security and Privacy Protection UX Checklist, 2021 ??

This is a really thoughtful & useful list to help guide the process of a team constructing software. Particularly great that it offers guidance on the root security of the research, design and implementation processes as well.

This checklist provides suggestions to promote digital security and privacy for people who are designing and developing tools for targeted communities.

The checklist addresses 3 phases:

1. PHASE I: Research and Ideation Before you start building the tool, platform, or technology, you want to know the people
   who will be using them. You need to collect and analyze information from your
   stakeholders and research participants.
2. PHASE II: Prototyping and Building With the initial research results, you now have a direction to build the prototype of your tool, tech, or platform. During this process, in particular to test your demo, you may have several checkpoints to refer back to or continue your initial research.
3. PHASE III: Release and Feedback Once you have a final product, prepare a thorough release strategy and document the
   process. It is very important to create a culture of feedback — always be open to feedback, and think of constructive ways to gather feedback.

[bumblefudge]

https://heather-buchel.com/blog/2023/07/just-normal-web-things/ , Heather Buchel, July 2023

Basically just a laundry-list of good UX primitives that were painstakingly pushed through W3C and into all the browsers just so abuses of JS/React/etc could trample all over the flowers. Realizing as I read through this list that it basically boils down to bad UX, usually done for lack of an actual UX professional being in the room or listened to if in the room 😭