Anonymous chat apps may not be as protective of users’ identities as we’d like to think.

Would you like to vent about your annoying coworkers without anyone finding out who you are? Do you have a marital indiscretion you want to confess but cannot risk your spouse finding out? Apparently, many people do, with secret-sharing apps like WhisperText, LLC (Whisper) reporting close to three billion monthly page views just two years after launch, and Open Garden’s FireChat mobile app signing up two new users per second in only its second week of public availability. Millions are turning to anonymous chat apps to confess all sorts of information in a very public yet purportedly secret way. Unfortunately, these apps might not be completely anonymous, and people who use them may risk having their identities exposed.

Would-be confessors can choose from a number of anonymous apps, each with their own slightly different feature sets and methods of anonymity. Some of the popular ones include: Whisper, Secret, Cloaq LLC, Yik Yak, Inc., Backchat and Burn Note, Inc. Many connect you to your social media and email contacts but strip away any personal data. It is somewhat like sitting blindfolded in a room filled with your friends and talking with them with your voices disguised. Others are completely anonymous and random, requiring no personal information from you (not even your email address), and connecting you with whomever happens to appear.

Ideally, you can share all kinds of dark secrets about yourself or others without anyone knowing it was you who posted the information. As a result, these apps have also become vehicles for trolls and cyberbullies to do their dirty work without being identified. Some have even used them to issue threats of violence against others. One anonymous chat bullying session led to a teen suicide. For most people, however, it is simply a convenient form of anonymous gossip or digital group therapy.

How anonymous is it?

Some might say anonymity on the Internet is an oxymoron. Social media in particular is, by its nature, meant to be open and social. Can a cloud of secrecy actually keep your identity safe? These four ways of uncovering user identities suggest the answer is no.

1. Good old-fashioned detective work – Although the “white hat hackers” who discovered this method might call it a hack, it is more of a clever workaround. They realized that they could find the identity of a Secret user by creating dummy accounts, each containing a contact list with one real user. As Secret shares posts to users’ friends by accessing their Contacts list, an identity can ultimately be unveiled when that user posts to a group of “fake” friends, thinking they’re sharing anonymously but the hacker will know who is posting.

 .

2. Willful disclosure – Most, if not all of the companies that offer anonymous chat services, have access to and keep user data. Some may just have an email address, while others might also use a phone’s location services to find nearby contacts. For example, Whisper admitted that it tracks its users and might even consider using that information for targeted advertising.

Secret’s own privacy policy reveals that it “may share information (which may at times include personal information about you…” with:

• “vendors, consultants and other services providers…”
• “in connection with, or during negotiations of, any merger, sale…” etc.
• “in accordance with any applicable law…”
• “if the content of a Post can reasonably be considered illegal or unlawful”

 .

3. Self exposure – Every person would like to believe they are smart enough to avoid accidentally giving away their own information on an anonymous website, but people often end up doing that without even realizing it. Your general location, the type of work you do and a physical trait you have, such as blond hair, might seem innocuous in isolation, but combine all three together and a stalker can narrow down the search for the identity of a person who fits your description.

 .

4. The illusion of the small audience – While apps like Secret and Yik Yak may each have methods of limiting the size of the groups of people who can see a person’s posts, all it takes is one person within that group to share it with others. Even if a post you make is not sharable through a “share” button or copying and pasting, a quick screen shot on a phone or computer can allow the ambitious spy to share your post with everyone. Your “anonymous” sharing with your twelve closest friends can suddenly become a “sharing” moment with 12 million other people.

Some of these services, such as Whisper, even go out of their way to make sure user posts go viral and are shared with as many people as possible. While this might not directly expose individual identities, it opens up a much wider audience and a larger group of potential privacy invaders that you might not have considered or authorized.

The more things change…

While these anonymous chat apps might be new, the concept of sharing information anonymously on the Internet is not. Sites like 4chan and Ask.fm have provided platforms for anonymous posting and confessions for years. These sites have also played host to some of the more epic trolling and bullying incidents in the history of the web, some that have even spilled over onto other sites.

These new services integrate well with mobile devices and make even grander promises of anonymity, at least on the surface. In truth, if National Security Agency (NSA) spying and constant “leaks” of celebrity photos and secrets have taught us anything, it is that nothing on the Internet is ever truly private. There is no guarantee that your information will ever be exposed by an anonymous chat app, but there is also clearly no guarantee that it will not. If you want your secrets safe, the best policy may still to keep them to yourself.

photo credit: Aleera via Flickr cc