Towards Privacy Analysis of Internet-based Messaging Applications

Privacy of Internet-based messaging applications involves establishing multiple requirements such as confidentiality, anonymity, pseudonymity, and consent, each typically addressed in isolation using different techniques. To the best of our knowledge, no unified framework supports the privacy analysis of these aspects together. Therefore, the main goal of our work is to detect privacy breaches based on a unified modelling of the relationship among the privacy requirements by static program analysis. In this paper, we present initial results on the privacy (i.e., confidentiality) analysis of Ejabberd server – an open-source XMPP backend server used by popular messaging applications like WhatsApp. Based on the confidentiality modelling, we perform a privacy analysis of key Ejabberd modules that are responsible for user authentication. The findings highlight the module implementations that involve potential privacy breaches and serve as a basis for our future work towards developing a unified privacy evaluation framework.