A messaging app popular with activists and protesters around the globe was found to have several major vulnerabilities that could compromise user privacy.
Bridgefy is a mesh messaging app that lets users send and receive texts to others nearby without requiring an internet connection. While the developers of the app say it’s ideal for communicating during large gatherings, natural disasters, or in school settings, the app’s publicized security and encryption features have made it a favorite for protesters in Hong Kong, the United States, India, Iran, Zimbabwe, Belarus, and Thailand.
Despite assurances that the communications sent by the app’s estimated 1.7 million users are encrypted and anonymous, a paper published this month by security researchers at the Royal Holloway University of London found that may not always be the case.
“Our results show that Bridgefy permits its users to be tracked, offers no authenticity, no effective confidentiality protections and lacks resilience against adversarially crafted messages,” stated the authors of the paper, concluding that ”participants of protests should avoid relying on Bridgefy until these vulnerabilities are addressed and highlight the resulting gap in the design space for secure messaging applications.”
Among the researchers’ findings were that users could be deanonymized, their messages could be intercepted, mesh networks could be disabled, and that the entire platform is vulnerable to man-in-the-middle attacks.
Bridgefy developers have acknowledged the security shortcomings and publicly announced that they were overhauling the app by integrating the Signal protocol, and will be “delegating all the security heavy lifting to the real experts.”
