Supporting Socially Constrained Private Communications with SecureWhispers

TL;DR

This paper introduces SecureWhispers, a method for establishing private, device-to-device communication secrets through shaking devices, enabling secure messaging without relying on third-party infrastructure, especially useful in constrained social contexts.

Contribution

It presents a novel shake-based secret generation technique and demonstrates its application in private messaging, trust delegation, and encrypted beacons, enhancing privacy in socially constrained environments.

Findings

Shared secret extraction from device shakes with 7.798 bits per byte.

Implementation of message obfuscation app on Android.

Usability and design considerations for privacy tools.

Abstract

Rapidly changing social norms and national, legal, and political conditions socially constrain people from discussing sensitive topics such as sexuality or religion. Such constrained, vulnerable minorities are often worried about inadvertent information disclosure and may be unsure about the extent to which their communications are being monitored in public or semi-public spaces like workplaces or cafes. Personal devices extend trust to the digital domain, making it desirable to have strictly private communication between trusted devices. Currently, messaging services like WhatsApp provide alternative means for exchanging sensitive private information, while personal safety apps such as Noonlight enable private signaling. However, these rely on third-party mechanisms for secure and private communication, which may not be accessible for justifiable reasons, such as insecure internet access or companion device connections. In these cases, it is challenging to achieve communication that is strictly private between two devices instead of user accounts without any dependency on third-party infrastructure. The goal of this paper is to support private communications by setting up a shared secret between two or more devices without sending any data on the network. We develop a method to create a shared secret between phones by shaking them together. Each device extracts the shared randomness from the shake, then conditions the randomness to 7.798 bits per byte of key material. This paper proposes three different applications of this generated shared secret: message obfuscation, trust delegation, and encrypted beacons. We have implemented the message obfuscation on Android as an independent app that can be used for private communication with trusted contacts. We also present research on the usability, design considerations, and further integration of these tools in mainstream services.