How To: New Self-Destructing Messaging App "Confide" Promises to Do Privacy Better Than Snapchat—But Do They Deliver?

When you post something online, it pretty much stays there. So it's no surprise that Snapchat, the self-destructive photo-sharing app, became such a huge hit, boasting an estimated 50 million users. Its ephemeral nature has proven popular, especially with teenagers—who are now well aware of the burden that permanence on the internet has.

Confide, a new iOS application, is now capitalizing on Snapchat's popularity and recent controversy by allowing users to send and receive confidential text messages that are fully encrypted and self-destruct after they're viewed. All with a decidedly more grown-up look and feel.

But does it live up to its promise? Let's take a look at how Confide works and then dig under the hood to check on its claims of self-destruction and encryption.

Sending & Receiving Self-Destructing Texts

As you sign in, you'll be asked to enter your first & last name, email and a password. The reason it asks for your email, aside from being a log in and certification tool, is because the application uses email address' in order to send the messages.

Common with most applications now, you can choose to allow Confide to access your contacts directly through Facebook or use your the contacts (with emails) on your device.

Once you confirm your email (be clicking on a link sent to you) you can start sending messages. To write a new message, tap on the new message icon on the top right, select an email from your contact list and write your message.

Note: The person you are sending a message to should also have Confide, but if they don't, they'll get an email prompting them to install it.

When you receive a message you have to open it and hold your finger down and swipe across the blocks, showing the message where your finger is. This is in order to combat someone trying to take a screenshot of the entire message, since only some of it shows at a time (left screenshot).

If you try and take a screenshot you'll be taken away from the message. When you try to re-open the message, you'll only be able to see who sent it and what the title was (right screenshot).

Below you can see the messages that you've sent (right) and the messages you've received (left). If they say Screenshot that means that the message receiver attempted to take a screenshot.

If they have a circle next to the message that means that the message hasn't been opened yet, while the checkmark signifies that the person you send the message to has read it.

Privacy

As Snapchat has recently been in the news for all the wrong reasons, Confide has been seizing the moment to try and steal some of their thunder. So, it's important to figure out if Confide has any similar security issues that can be breached by hackers. So far the application hasn't been out long enough for an exploit to appear, but Confide mentions in their Privacy Policy that—

"We do not read your Messages, and although we strive to delete your Message Information as soon as a Message is successfully read, we cannot guarantee that all Message Information will be completely deleted. Accordingly, we cannot – and do not – guarantee that the Message Information will be deleted."

Looking Under the Hood

As many of you know by now, it's fairly trivial to retrieve Snapchat's supposedly secure message contents by browsing your phone's file system. As such, I set out to do the same with Confide, seeing as they explicitly chose not to guarantee messages are deleted in their privacy policy.

Using iFunBox, an iOS file system explorer for Windows, I was able to view the data on Confide, which consisted of Address Book Users, Archived Messages, Conversations, Messages and more.

All of the messages that I had sent and received were encrypted so I was not able to read them, but the meta data was not. I was able to view my email and the emails of the people that have sent and received messages to myself.

What this tells me is that while the messages are encrypted, the meta data isn't. Further more, they're not totally gone from the system and are available for retrieval and by anyone with physical access to your phone.

The Verdict

Confide's encrypted storage of message contents are indeed a step above Snapchat's plain text storage, so we'll give them that. But totally self-destructing, these messages are not. That said, until someone breaks their encryption keys, your messages are indeed impossible to retrieve. My only hope is that they aren't keeping these around on their servers any longer than it takes to deliver them to their recipient.