# Exploiting Online Services to Enable Anonymous and Confidential Messaging
## 2 Related Work  
The presented related work focuses on proposals that intend to exploit online services by combining the use of steganography techniques and tools to enable concealed communication between users without enabling server access to the exchanged messages. In [17], a comparison between various messaging applications' security levels is presented. The paper goes into detail as to what security flaws or strengths each application provides and an overall result on whether each application should be considered trustworthy to manage a user's private data. Among the presented applications, this paper focuses only on the ones recommended: Signal [18], Threema [19], Wire [20], and Session [21]. The solution proposed in this paper is unique and has advantages over all these messaging applications. Although Signal does not present major security flaws, it requires new users to offer their mobile phone number to register a new account (and also for recovery purposes). This information, sent to parent companies, is a breach of anonymity, linking a user's cyberspace presence to their real personage. Furthermore, the requirement to give a phone number relies on the user having a mobile phone. Wire also has this issue of giving parent or third-party companies information, more specifically, e-mail and/or a phone number, which is required to register a new account to start using the service. Once again, this is a breach of anonymity. As presented, both of these applications fail the anonymity check--it is impossible to use these applications without some link to the user's real persona. Threema does not have registration as a mandatory requirement. It gives the user the choice to insert a phone number for recovery purposes, but this is optional. That said, their application API and server code are not open-source. Furthermore, it is a paid application. Session makes use of blockchain technology to provide its own onion routing service. When a user sends a message, it is carried through three different nodes on the network before passing through a listening node and once again hopping through three different nodes. Since each node only has information regarding its adjacent nodes (i.e., the first node to receive the message only knows the IP of the sender and the second node--not the recipient's IP), privacy is ensured. The application relies, for the most part, on local storage, with the exception being temporary storage of messages in multiple nodes, designated a swarm, which get deleted after the messages Time To Live (TTL) are surpassed if the recipient is offline. However, this network requires nodes. In order for a node to be authorized and accepted to the system, a stake must be made, requiring the owner of the node to lock a certain monetary value to the node. Afterwards, the person responsible receives a reward for their node's usage. On the one hand, this makes it quite costly for anyone attempting to attack the network; however, the reward system may also create a conflict of interests between maintaining privacy vs. abusing this system. The proposed solution is to be built as cross-platform, so it does not rely on a mobile phone for proper usage. It is currently planned to be fully open-source and free. No registration is required--each account has a unique ID, and a new account (or ID) can be created at any time to replace the older one (along with the old ID's data). All data are transferred through images that are uploaded anonymously and hosted on various image-hosting services. These images are only available through their ID and are deleted after a certain amount of time. Although an attacker may see that an image is being uploaded, the solution relies on the inconspicuousness of the scenario to avoid suspicion. Table 1 presents an overview of the security level of each messaging application already available and the proposed solution. A set of research works proposed the use of steganography to provide messaging services.