PSA: Your chat and call apps may leak your IP address
Your favorite email and the calling app could reveal your IP address to the person on the other end. And this, essentially, is because most chat apps use peer-to-peer connections by default – meaning you and the person you’re talking to connect directly to each other – to improve call quality.
It’s not necessarily a huge risk. But, experts say, it’s not clear whether users are aware of this potential privacy issue or how calls work through popular messaging apps such as Telegram, Signal, WhatsApp, Facebook Messenger, Apple’s FaceTime, Viber, Snapchat and Threema.
“Even for users with more extreme threat models, I think most of them are unaware that the calls can leak their IP address to the person they are calling,” Cooper Quintin, research researcher security at Electronic Frontier. Foundation, told TechCrunch.
Matthew Green, professor of cryptography at Johns Hopkins University, said the (formerly Twitter) that he did not realize that Signal was revealing IP addresses during calls between contacts. Green also added that it’s likely that many users don’t know about it either.
“Whenever someone sets a feature as the default, my guess is 95% of users never touch it. When they put it in the “Privacy” settings menu, I raise my expectations to 99%. But Privacy > Settings > Advanced? I would bet we are at 99.8% now. Green wrotereferring to the option to completely disable peer-to-peer calls on Signal.
IP addresses do not reveal your precise location, but can still pose a risk to users whose IP addresses are exposed, especially to victims of abuse, according to Runa Sandvik, digital security expert and founder of Granitt, a startup that helps defend at-risk users. IP addresses can also be linked to a person’s Internet activity, which can users to monitoring.
Experts agree that there is no one-size-fits-all solution and that it is a complex problem.
“It’s hard to know what would be the best way to do this,” said Quintin, who has studied security and privacy of multiple messaging apps. “I don’t think there is an effective way to perfectly protect everyone’s privacy at all times. Callers can reveal their IP address to each other. Or, the encrypted messaging app’s proxy servers may have a list of everyone calling everyone. And law enforcement can potentially access it.
Telegram
In October, we reported that Telegram leaks users’ IP addresses during calls made between contacts. Security researcher Denis Simonov, also known as n0a, makes a relatively easy to use tool which is designed to capture the other person’s IP address during a call, provided that both callers are in each other’s contacts. Telegram reveals users’ IP addresses in these circumstances because calls between contacts are by default peer-to-peer in an effort to have better “quality and lower latency,” according to Telegram spokesperson Remi Vaughn .
“The downside is that this requires both parties to know each other’s IP addresses (since it’s a direct connection). Unlike other messengers, calls from those who are not in your contact list will be routed through Telegram’s servers to hide this,” Vaughn told TechCrunch.
Other apps work similarly and may also leak IP addresses. Below, we review some of the world’s most popular chat and calling apps and explain how they work and under what circumstances they can reveal IP addresses between callers. (Note: All instructions below are for iOS apps).
Signal
In a blog post About the launch of video calls on Signal starting in 2017, Signal founder Moxie Marlinspike wrote that from then on, Signal would establish a peer-to-peer connection in calls between contacts. Otherwise, Signal would still relay calls through its servers, which would result in masking the caller’s IP addresses.
“By default, Signal will only attempt to establish a P2P network. [peer-to-peer] connection if you initiate the call or receive a call from someone in your contacts. If you receive a call from someone not in your address book, Signal will relay that call through the Signal service,” Marlinspike wrote.
It’s important to remember that Signal’s messages and calls are end-to-end encrypted by default, meaning the company cannot see or listen to the content of any communication.
Just like Telegram, which has an option to disable peer-to-peer by default and thus avoid leaking users’ IP addresses, Signal also offers this option.
If you want to completely eliminate the risk of exposing your IP address on Signal, tap your avatar in the top left, tap Settings, then Privacy, scroll down to Advanced, and enable the “Always Relay Calls” option. . .
Signal settings in iOS to disable peer-to-peer calls. Image credits: TechCrunch
Signal chose to make peer-to-peer calls the default between contacts to offer users calls with better audio quality and less latency, according to Signal President Meredith Whittaker.
“If we had Relay as the default, it wouldn’t work well for many people in various parts of the world. Peer to peer is faster and more performant, which in many cases is the difference between whether the feature works or not,” Whittaker told TechCrunch. “So ultimately it’s not just about performance, it’s more about will this work for people? issue.”
According to Josh Lund, Signal’s senior technical editor, what Signal does is now the industry standard. “Using peer to peer connections is exactly how VoIP applications work. And I think that’s a very important point to represent accurately,” Lund said.
Meta-owned WhatsApp, one of, if not the most popular chat apps in the world, is designed to automatically switch between peer-to-peer and relayed calls, WhatsApp said.
This choice depends on call latency and the option offering better call quality. Sometimes it’s peer-to-peer, sometimes it’s better to relay the call through the WhatsApp server, depending on WhatsApp. Just like Signal, WhatsApp messages and calls are end-to-end encrypted by default.
As of this writing, users do not have the option to turn off peer-to-peer calls like they do on Signal. But, according to WhatsApp, the company has deployed an optional feature, already present in beta versions – this would give WhatsApp users the ability to hide their IP address from other people they call, something the company plans to fully roll out in the coming weeks.
By enabling this feature, all calls will go through WhatsApp servers. In other words, WhatsApp will soon give users the option to opt out of peer-to-peer calls altogether, just like Signal and Telegram currently do.
FaceTime
Apple’s FaceTime, which is also end-to-end encrypted by default, uses peer-to-peer connections for every call, according to Apple security documentation.
“When the user answers the call, audio is transmitted seamlessly from their iPhone over a secure peer-to-peer connection between the two devices,” Apple explains in the guide.
There is no option to disable this peer-to-peer connection. Apple did not respond to a request for comment.
Facebook Messenger
Facebook Messenger makes it clear in a help page that “in audio or video calls between just two people, your IP address will be shared with the other person’s device to establish a peer-to-peer connection.”
“A peer-to-peer connection uses your IP address to connect you directly with the person you are calling to improve the audio and video quality of your call. Although this happens in the background, it is possible that the other person discovers your IP address,” the page states.
Meta spokesperson Alex Dziedzan told TechCrunch that “if you answer a call on Messenger, you will share your IP address. You cannot turn off calls as a feature.
Snapchat
It’s unclear how Snapchat calls work and whether or not they leak IP addresses. There is no reference to the use of peer-to-peer calls or whether the calls expose IP addresses anywhere on the official Snapchat website. Snapchat did not respond to requests for comment.
Viber
On its website, Viber states that “peer-to-peer is only used in one-on-one calls on Viber.” And that users can choose to disable peer-to-peer communication so that “your IP address will no longer be used in your Viber calls, but this will reduce the quality of your calls.”
To turn off peer-to-peer calls, go to More in the bottom left corner with the three dots, tap Settings, then Privacy, scroll down and turn off the “Use Peer-to-Peer” toggle.
Viber settings in iOS to disable peer-to-peer calls. Image credits: TechCrunch
Viber did not respond to a request for comment.
Troisma
Privacy-conscious messaging app Threema works similarly to Signal. Threema spokesperson Julia Weiss told TechCrunch that calls between “unverified contacts” are “always routed through the Threema server in order to mask the IP address.”
Users who verify each other, either by scanning their QR code or Threema ID in real life, or through contact discovery (a system that allows users to link their Threema ID to their phone numbers or email addresses ) will see their calls be peer-to-peer. default peer.
Threema settings in iOS to disable peer-to-peer calls. Image credits: TechCrunch
And, like Signal and Telegram, Threema users can turn off peer-to-peer by default, routing all calls through its relay servers.
To enable this option, go to Settings, Threema Calls, then enable “Always relay calls”.
Read more on TechCrunch:
