Google Allo: The New Chat App Creates Serious Security and Privacy Concerns
Google recently released Allo (https://allo.google.com/), a new messaging app equipped with various powerful features. It offers, for example, “Smart Reply” – a feature that suggests responses to messages and images that you receive. For example, if someone sends you a photo of his or her pet dog, Smart Reply might suggest “Cute dog!” “Wow! Beautiful lab” or the like – all able to be sent with a single tap – thereby, making responding faster and easier. Allo also learns how you speak and adjusts its suggested responses – which can include emojis as well - accordingly.
But this power comes at a price – and Allo has security and privacy experts worried. Here are some of the relevant concerns, and, some ways to address them (when applicable).
1. Google stores your confidential conversations - Allo chat sessions are retained on Google’s servers. While Google has an army of security professionals dedicated to securing its server farms and the data within them – so storing your data there does provide some benefit over storing it on your devices or home computer – the fact that your private communications reside on Google’s servers could pose a serious risk. Law enforcement and others may be able to obtain copies of your communications without your knowledge, as might sophisticated hackers or corrupt insiders. Someone suing a third party with whom you have had a conversation in the past might also be able to obtain a court order to see communications that you consider to be private. From a privacy standpoint, therefore, it might be far better if Google Allo chat sessions were, by default, retained solely on users’ devices; people who want their data stored on Google’s servers should have to actively opt in to such a feature.
2. Communications are not encrypted by default - By default, Google Allo does not employ end-to-end encryption for messages. This means that your confidential communications sent via Allo are at increased risk of being read by unauthorized parties while the messages are in transit versus the risk had they been sent via an encrypted messaging platform. Yes, you can use Google Allo’s so-called “Incognito Mode” to encrypt your conversations – but this mode is not enabled by default, likely leading to many users not turning it on. It is worthwhile to note that the lack of end-to-end encryption combined with the aforementioned concern about Google storing conversations on its servers creates a 1+1=3 type of privacy nightmare; unencrypted messages stored on a third-party server is hardly an ideal situation.
3. Your messages may be spied on by the United States Government – The two aforementioned concerns together mean that if amy agencies of the United States government desire to see your communications they may be able to obtain a warrant and force Google to share the requested information. In some cases, such warrants can be obtained without your knowledge, and with Google prohibited by law to even inform you that they have shared the information with the government.
4. Google runs analysis on chat sessions – One of the powerful features of Google Allo is that Google’s artificial intelligence technology (part of its new Google Assistant as will be discussed later), which, as alluded to before, can suggest replies and provide information to users – but this obviously is not something that many people would want done on private conversations. Turning on Incognito mode disables such features, but doing so also might negate a major reason to switch to Allo from other messaging platforms.
5. The Allo “Google Assistant” may compromise privacy in several ways - In addition to the aforementioned automated responses, Google Allo comes equipped with the full preview version of the “Google Assistant” (https://assistant.google.com/) – with which users can chat directly. While having natural conversations with an AI might be useful, it also creates serious risks. By default, it seems, conversations between humans and Assistant are not encrypted, and remain on Google’s servers indefinitely, unless you delete them. Google also knows what you are asking – and stores that information. (To delete your chat sessions with the Google Assistant AI, go into the relevant chat session and tap on the menu button in the top right corner of the Allo app, click Clear History, and then Delete.)
6. Google stores Metadata about chat sessions – Regardless of whether or not you enable Incognito mode, Google stores metadata about your session. Even if a warrant-possessing government agency cannot see what you wrote during an end-to-end-encrypted session, it can determine with whom you spoke and when, as well as other information about your communications. This privacy issue also exists in other messaging platforms.
Of course, there are other issues, and general security concerns that surround all apps – never download Allo, for example, from any source other than the official Google Play store, or your device may be infected by malware.
For some people, the benefits of Allo may outweigh its drawbacks. But, be aware of the risks – and how to mitigate against them -- before you use it.
About the On-Demand Webinar
About the Webinar