Without access, the computer scientist had to rely on Wire’s documentation on security and privacy to make critical assessments. Many of the problems the report identifies stem from that code. The company’s response indicates that they want to address many of these issues in the coming year, including by opening up the server code behind it the app, within the first quarter of 2017.

While these problems are unaddressed, users should avoid using Wire audio/video calls for secure conversations, assume that Wire passwords could be silently compromised, treat the Wire application like a constantly updating web service rather than a semi-stable desktop application, and consider sandboxing Wire on sensitive systems.” Users should be aware of these concerns before choosing to use Wire. “The chat features offered by Wire have a very modern aesthetic that is very popular with users, and this makes Wire a very interesting offering. “The problems listed above weaken the security of Wire relative to competitors like Signal, but the problems are not insurmountable,” the author wrote. A unnamed researcher at Waterloo’s Cryptography, Security, and Privacy (CrySP) lab, wrote users “should avoid Wire audio/video calls for secure conversations” until the problems are rectified. Wire, created by Skype technologists including co-founder Janus Friis, is being dinged for closed-source server code, problems in call and account authentication as well as problems with an overly complex code structure that make the attack surface very large. Wire, a popular secure messaging app with over 1 million downloads, ended 2016 by fielding a potent list of criticism after a researcher at the University of Waterloo concluded that “users should avoid using the service while numerous problems remain unfixed.

Signal messenger security audit