Oorschot. Secure public Instant Messaging A survey.pdf

Secure Public Instant Messaging: A Survey ? Mohammad Mannan School of Computer Science Carleton University Ottawa, Ontario, K1S 5B6 Email: mmannan@scs.carleton.ca P.C. van Oorschot School of Computer Science Carleton University Ottawa, Ontario, K1S 5B6 Email: paulv@scs.carleton.ca Abstract We provide a survey on security features and threats to existing Instant Messaging (IM) networks and discuss how currently available systems fail to provide adequate security in light of existing threats. Our discussion and analysis provide a starting point from which to advance academic research in the area of secure IM systems, enabling security improvement in the longer term. I. INTRODUCTION AND OVERVIEW Instant Messaging (IM) is a type of communications service over the Internet that enables individuals to exchange text messages and track availability of a list of users in real-time. IM systems have been around since the UNIX applications talk and write. IM usage increased with the early implementations of the MIT Project Athena Zephyr notification system [1], and IRC (started at University of Oulu in Finland; RFC1459 [2], RFC2810 [3]). However, the increasing popularity of consumer IM services in the recent past is phenomenal. Giga Information Group, a market research firm, estimates that about 325 million people worldwide will use consumer IM applications in the year 2003 [4]. Starting as a casual application, mainly used by teenagers and college students, IM systems now connect even naval operations (over 300 US Navy warships are connected via IM service) to various customer services [5]. There are many free public domain instant messaging services. The most popular are AOL Instant Messenger (AIM), ICQ, MSN Messenger (Windows Messenger in XP), and Yahoo! Instant Messenger (YIM). This paper focuses on these messaging networks and their default clients. 1 There are also many other third-party clients that interact on these networks. We discuss both the third party and default