Confide App Lawsuit: Encrypted Messaging App Used By White House Staff Not So Secure

End-to-end encryption app Confide, which is used by staff at the White House, has been hit with a lawsuit for failing to deliver promised security features, documents uploaded by Recode show.

President Donald Trump’s administration reportedly is using Confide to curb leaks to the press. However, the app may not be as safe as it claims, the lawsuit alleges.

The primary complaint in the suit, which was filed by a Michigan man Thursday federal court in Manhattan, centers around the app’s failure to block screenshots of conversations from being taken by a person using the app on a desktop computer.

Read: Telegram App Introduces Encrypted Voice Calls To Compete With WhatsApp, Signal

Confide messages disappear after they have been read on mobile devices. The app also protects against screenshots by displaying a gray box and notifying the sender a screenshot was attempted.

That notification is not provided if the user is on a desktop device.

In addition, the desktop version of Confide displays messages in full, rather than line-by-line like the mobile app does. According to the lawsuit, these discrepancies aren’t purely aesthetic differences in the interface but present an actual security risk.

“Confide prevents screenshots on most of our platforms,” the app’s site says. “Where prevention is not technically feasible, our patent-pending reading experience ensures that only a sliver of the message is unveiled at a time and that the sender’s name is not visible. We also kick the recipient out of the message and notify the sender that a screenshot has been attempted.”

However, “any Confide user accessing the platform through the Windows App can take screenshots of any and all received messages,” the lawsuit alleges. “Those screenshots can include the entire content of the message as well as the identity of the sending party despite Confide’s explicit claims that such information would not be visible at the same time [i.e., only a“sliver” of the text would be visible].”

Read: Signal App Update: How To Make Encrypted, Secure Video Calls

The lawsuit included a photo of screenshots of the app’s messages:

The suit accused the app of deceiving customers by leading them to believe the “platform would allow them to send and receive messages with screenshot protection even when it didn’t design Apps to provide those protections.”

A note about screenshot prevention not being “technically feasible” on some platforms appeared on the Confide website as early as Jan. 31, 2016, according to an archived version of the site saved by the Internet Archive. Earlier versions of the site do include a message suggesting the desktop version of the app prevents screenshots.

“The accusations set forth in the complaint are unfounded and without merit. We look forward to responding to this frivolous complaint and seeing this case swiftly thrown out of court," Confide co-founder Jon Brod told Ars Technica.

Lawsuit aside, users should remember apps that protect against screenshots don’t protect against photographs with a second device with a camera.