# Exploiting Online Services to Enable Anonymous and Confidential Messaging
## 5 Discussion  
The objective of the proposed messaging service is to enable covert communication guaranteeing the confidentiality, integrity, and authentication of the exchanged messages while using images as containers for the message exchange. Considering that the envisioned concept makes use of online services, the Dolev-Yao intruder model [44] was considered adequate for this security analysis. The Dolev-Yao intruder model states that the intruder has full control over the network, being capable of reading, altering, or deleting data in transit. In the designed PoC, the KDF, Secure Random Generator (SRG) [45, 46, 47], and HMAC are assumed to be secure, and the channel's password and salt are assumed to be previously exchanged in a secure manner, preferably in-person, and generated using a SRG. Moreover, it is also assumed that the UUID is securely generated and that the used images are either chosen randomly from online galleries or from the user's gallery accordingly to user preference. Following these assumptions, a discussion can be made about user anonymization, message confidentiality, message integrity, and system availability. Figure 4: Runtimes (in milliseconds) per step and image size, normalized to 100%. User anonymity is assured with the usage of generally available online services that accept unauthenticated usage, combined with the inability to distinguish between users that take part in a channel. Only users having the password and salt of a channel can read messages exchanged in that channel, and it is also assumed that user equipment is secure in a way that the used services do not collude or pursue user reidentification based on their access patterns or IP address (such as a non-rooted phone). Aside from using multiple services, users can also rely on Virtual Private Network (VPN) [48, 49, 50, 51, 52] services or a custom-built service on the TOR [53] network to enhance user anonymity. Furthermore, the Exchangeable Image File Format (EXIF) data is removed from all images used so that no location data, for instance, is left. Message confidentiality is assured with the use of secure functions for KDF, SRG, and encryption. The channel key (\(C_{i}\)) is derived using a KDF such as Argon2 [42, 43]. A unique, random, and securely generated IV (\(IV_{i}\)) is also used for each message. Integrity is guaranteed by calculating a hash value (\(H_{i}\)) for each message using a secure HMAC function that receives the encrypted message (\(E_{i}\)) and the current IV (\(IV_{i}\)) as parameters. The hash value will always be unique due to the freshness of the \(IV_{i}\), even if the message (\(msg\)) is the same. The \(msg\) and \(H_{i}\) are only exchanged while encrypted, making them unable to be changed outside of the channel without detection. The availability of the proposed PoC is considered to be partially assured since the user is reliant on multiple, externally controlled online services. The PoC is based on currently existing technology and services; however, an advanced user may create his/her own image-hosting service as an alternative in case the available hosting services change operation procedures or experience a shutdown. Further, while an attacker may not be able to easily delete the image from the chosen image-hosting service, he/she can, however, delete the URL from the text-hosting service if he/she knows the used filename (UUID\({}_{i}\)). Because the used online text-sharing service does support Transport Layer Security (TLS), the use of a VPN connection is assumed. If a URL is deleted from the text-hosting service prior to being read by the recipient, the recipient will not even realize that a new message had been sent. We argue that the risk of such behaviour is outweighed by the eventual loss of privacy associated with numbering messages and keeping a record of which ones are read by whom.