sex, lies, or kittens? investigating the use of snapchat’s self-destructing messages

Sex, Lies, or Kittens? Investigating the Use of

Snapchat’s Self-Destructing Messages

Franziska Roesner1, Brian T. Gill2, Tadayoshi Kohno1

1 University of Washington, Computer Science & Engineering2 Seattle Pacific University, Mathematics

2

Snapchat: Disappearing Messages

Official Snapchat screenshots (https://play.google.com/store/apps/details?id=com.snapchat.android).

As of late 2013:- 350 million “snaps” per day.- Estimated over 30 million active

users.- Attempted purchase by Facebook:

$3B.

3

Snapchat: The Sexting App?

http://dacoolcat.tumblr.com

Research Question: How and for what do people really use Snapchat?

4

Snapchat: Not Actually Secure!Snapchat messages can be saved…(1)Via screenshots (sometimes secretly).(2)Retrieval after deletion.

Research Questions: - What are user’s

screenshot practices and reactions?

- Do people trust Snapchat, and does that affect use?

5

Our Research Questions1.Usage Patterns: How and for what do

people really use Snapchat?2.Screenshot Practices: What are

users’ screenshot practices and reactions?

3.Effect of Security Weaknesses: Do people trust Snapchat, and does that affect use?

6

Outline• Background and Motivation• User Survey Results• Implications• Summary

7

Outline• Background and Motivation• User Survey Results• Implications• Summary

8

User Survey127 adult Snapchat users.(206 initial participants: 18 screened out for not knowing Snapchat, 61 for not using it.)Recruited via social media + university email lists.Up to 41 questions, 15-30 minutes.

Limitations: adults, snowball sampling (high security expertise), multiple choice, possible under-reporting.

9

Demographics (1/2)68.5% male, 29.9% female.Skewed towards younger adults:– 81.9% age 18-24 – 14.2% age 25-34– 1.6% age 35-44– 0% age 45-54– 1.6% age 55-64

10

Demographics (2/2)Skewed towards higher security expertise (but no detected effect on most responses).

5% Novice --- 17% --- 29% --- 31% --- 13% Expert

Westin Privacy Index:– 39% Privacy Fundamentalists– 46% Privacy Pragmatists– 13% Privacy Unconcerned

11

Our Research Questions1.Usage Patterns: How and for what do

people really use Snapchat?2.Screenshot Practices: What are

users’ screenshot practices and reactions?

3.Effect of Security Weaknesses: Do people trust Snapchat, and does that affect use?

12

(1) Usage PatternsDo respondents send sensitive content?Does message timeout behavior reflect privacy considerations?Do respondents use Snapchat for security and/or privacy reasons?

13

Sensitive Content?Sending sensitive content is uncommon, though up to 25% may do so experimentally.

14

Useful for Non-Sensitive Content“It lets me have more cats in my life because my friends who don’t normally post pictures of their cats on other social media will snapchat their cats to me.”

“The fun of it is you can send a stupid face or a snapshot of what’s happening. The communication is compact and fast.”

“There should be an option to recognize faces and add moustaches to those faces.”

15

Message Timeout Behavior47.2% change timeout based on content/recipient.Shorter timeouts:– 22.8% for embarrassing photos.– 10.0% for secret information.– 10.0% for less trusted recipients.

Longer timeouts:– 18.9% for more trusted recipients.– 9.4% (write-in) for complex content.

16

Why Snapchat?46.5% use it because content is unlikely to be saved.Not necessarily for privacy reasons!

66.1% use it because it’s simple, 55.9% because it’s fun.

“Expectation of spam means it’s okay to spam.”

“Some content, whether or not it’s risque, does not need to be seen more than once (e.g., photos of food).”

17

(2) Screenshot Practices

How often do respondents take screenshots?How do respondents and their contacts react to screenshots?

18

Screenshot BehaviorScreenshots are common: 47.2% report taking screenshots, 52.8% have had them taken.(3.9% have used a separate camera.)

Most respondents don’t intend to violate trust, but 10.2% say they have taken a screenshot to embarrass the sender.“We have a tacit agreement that if the

timeout is 10sec, then a screenshot is almost expected.”

19

Screenshot Reactions

Screenshots are not usually a trust violation.

20

(3) Effect of Security WeaknessesDo respondents know that Snapchat message destruction is insecure?Do respondents report security-related behavior changes?Does lack of trust in Snapchat affect content respondents send?

21

Understanding (In)Security A majority of respondents understands that Snapchat is not secure: 79.5% know or suspect that recovering messages is possible.Only 14.1% “know” or think that message recovery is impossible.

22

Reported Behavior Changes52.8% would not change their behavior in response to learning that Snapchat is insecure.38.6% would change / have changed behavior:– 24.4% would use it differently.– 14.2% would use it less.

23

Observed Behavior ChangesA majority of respondents is unwilling to send certain types of content via Snapchat: sexual, documents, legally questionable, mean/offensive/insulting.

Why?Most because they “never take pictures of that sort of thing” (30.7 – 73.2%).The rest are concerned about Snapchat insecurity (up to 14.2%) and screenshots (up to 25.2%).

24

Outline• Background and Motivation• User Survey Results• Implications• Summary

25

Implications for SnapchatMisconception #1: Primarily for sensitive content.

Misconception #2: Success threatened by vulnerabilities.

Suggests: Snapchat should (and does) market itself differently.

Snapchat “has a bad reputation (for sexting).”

“It seems useful only for inappropriate content.”

26

Implications for Secure Messaging

A sizable fraction of respondents reported security-related behavior modifications.

Suggests: Many users would still benefit from a more secure messaging application.

“I like the idea of Snapchat, but it definitely worries me that the photos are ‘out there’ somewhere, even if the snaps I’m sending don’t have sensitive content.”

27

Open Questions• How do teenagers use Snapchat?• How much did respondents under-

report sensitive behaviors?• How well do our survey results

generalize to a broader population?

Suggests: future, more behavioral studies of Snapchat needed.

28

Outline• Background and Motivation• User Survey Results• Implications• Summary

29

SummarySecurity and privacy in Snapchat are not major concerns for the majority of respondents.Most understand that message destruction is insecure.But: many have/would adapt behavior due to lack of trust or security issues.