Messaging Apps - Analyzing Permissions on Android Devices

What Happened

A recent analysis focused on three popular messaging apps—Messenger, Signal, and Telegram—to evaluate their permission requests on Android devices. Each app's approach to permissions significantly impacts user privacy and data security.

Permissions Define Access to Device and User Data

The study revealed that these apps have varying numbers of permissions. Telegram requests the least, with 71 total permissions, including 25 dangerous permissions. Signal follows closely with 72 permissions, of which 19 are dangerous. In contrast, Messenger leads with 87 permissions, including 24 dangerous ones. Notably, Messenger also requests a number of vendor-specific permissions, which are not standard in Android.

Core Messaging Features Rely on Sensitive Permissions

Messaging apps need access to sensitive resources to function effectively. Permissions for contacts, camera, microphone, location, storage, and calendar are essential for core features like voice messages and video calls. While Telegram and Messenger extend their access with system-level permissions, Signal opts for a more conservative approach, avoiding permissions related to phone calls and background location.

Configuration and Network Handling Differences

Using the Mobile Security Framework (MobSF) for static analysis, researchers found that all three apps fall into a medium risk category. However, Messenger had more flagged issues, particularly in the medium-severity range.

One significant difference lies in how each app handles network traffic. Telegram allows cleartext connections by default, making it vulnerable to interception. In contrast, Signal uses encrypted connections, limiting cleartext traffic to necessary certificate checks. Messenger's findings were more varied, including issues like world-writable files that could allow data tampering.

Where Data Travels

The analysis also examined where the data from these apps travels. Messenger primarily exchanges traffic with North America, while Telegram focuses on Europe. Signal also has a strong presence in Europe, with connections in the United States and Asia. This geographical distribution can have implications for data privacy and compliance with regional regulations.

Conclusion

Understanding the permission landscape of these messaging apps is crucial for users concerned about their privacy. While Telegram appears to take the most limited approach, Messenger's extensive permissions raise questions about data security. Users should consider these factors when choosing a messaging app.