Think that one has sent a personal message to someone and only your friend will view it. Suppose, now, that anyone can read that message, who happens to get his hands on it, as in a postcard sent without an envelope. That is the frightening reality of the users of the Arattai messaging app.
Recent findings have revealed that Arattai, a tool of popular communication is not doing so well in keeping your conversations secret. It is not just a small glitch, but a big security issue and it is raising big alarm bells on privacy experts and even regulators.
The Major Issue: Messages in Plaintext.
The key to the problem is what is referred to as encryption. Imagine the encryption to be some secret language, which mixes up your message and makes it unreadable to anyone except the receiver it is addressed to. It is as though you put your personal letter in the most secure and locked box and send it. It can only be opened and read by the individual who has the correct key.
The problem with Arattai? Most of its messages seem to be in-text. This implies that your messages, pictures and even sensitive data that you post might be stored and forwarded in plain text- basically, as writing on an open postcard.
Why is this a big deal?
- Easy to intercept: When your communication is not encrypted, it is much easier to be intercepted by hackers or even by just a curious person to read through as it flows over the internet.
- Breaches of data are even more terrible: In case Arattai is ever a victim of data breach (when hackers steal the information stored on their server), the thieves would read the unencrypted messages instantly. Even stolen data could not be of use without the encryption key, had they been encrypted.
- Privacy nightmares: To those who talk about personal health, money, work secrets, or simply feel like having an open chat, the thought of their discussions not being private is an unsettling concept.
GDPR Compliance Alarms: Headache in Legality of Arattai.
This unencryption is not only a technical problem, but a legal problem. It casts severe doubts on whether Arattai complies with key privacy regulations, in particular, the General Data Protection Regulation (GDPR).
What is GDPR?
GDPR is a stringent privacy legislation in Europe that covers the methods by which firms gather, utilize, and store the personal data of the individuals. It is said to be the best privacy legislation in the world and it sets a benchmark in data protection. A company that does not have a presence in Europe necessarily has to adhere to GDPR, even though it may not be located in Europe.
The compatibility of the unencrypted messages of Arattai with GDPR:
- Privacy by Design and Default: GDPR states that the privacy must be designed into the products and services, rather than be added afterwards. One of the components of privacy by design in a messaging app is strong encryption, which appears to be failing in Arattai.
- Security of Processing: GDPR requires companies to apply the relevant security measures to secure the personal data. Plaintext messages represent an enormous threat signal. It is an indication that it is not securing the data.
- Data Minimisation: Although this is not related to encryption per se, the GDPR ethos suggests that data should be collected and processed only to the extent that it is absolutely necessary and be guarded with a scythe. Encryption of messages is not in keeping with this ethos of robust data protection.
- Risk of Harm: Exposing personal messages may result into identity theft, fraud, and harassment or other potentially harmful effects to users. The GDPR intends to avoid this harm.
The repercussions of this to Arattai might be dire:
- Hefty Fines: GDPR breaches may result in colossal fines, no less than 4% of a company’s yearly income all around the globe or 20 million Euro, whichever is greater. To a technologic company, this may be catastrophic.
- Loss of Trust: Worse than fines, users will lose trust in an app that does not allow them to keep their messages secret. When trust is lost it is extremely difficult to regain.
- Reputational Damage: Privacy failures are also publicized fast and cause negative publicity to a company and render it more difficult to attract new users.
What Should Users Do?
This is worrisome news, particularly if you are an Arattai user. The following are what you should take into consideration:
- Keep your mail tidy: Until Arattai gets these bugs sorted out, suppose that anything you post might be read by someone. Do not post highly personal, financial or confidential information.
- Think outside the box: There are numerous other messaging apps that value strong encryption. Applications such as Signal, Telegram (when using secret chats), and WhatsApp provide end-to-end protection, i.e. the messages are read only by the receiver and the sender.
- Demand privacy: As people who use it, we can demand that the companies safeguard our data. Assure Arattai that you value privacy and security.
What Arattai Has to Do (and Do it Fast!).
Arattai must act firmly and decisively to act upon these privacy traps.
- Apply End-to-End Encryption: It is the most important step. Messages, calls, and shared files must be encrypted right after leaving the device of the sender till the receiver gets the message. They should not be read by anyone and they should not even be read by arattai itself.
- Audit Security Systems: Their complete security infrastructure should be reviewed so that they can find and eliminate all vulnerabilities.
- Be Open and Communicative: Arattai must be transparent and honest with its users, to understand what has gone wrong and what they are doing to rectify the issue and when users can trust that they have a truly safe place.
- Crowdsource Privacy Experts: Get independent privacy and security experts to work on your solution to ensure that it is robust and that it complies with legal and ethical requirements.
- Adhere to the GDPR: All the practices in dealing with data must be in full adherence to the GDPR in addition to other applicable privacy laws across the globe.
The Future of Online privacy.
This is what happened with Arattai, and it is a clear indication of the relevance of digital privacy in our globalized society. We use a lot of our lives over the internet, so it is crucial that the tools we are taking advantage of are constructed keeping our safety and privacy in mind. Businesses have a duty of safeguarding our information and consumers have the right to the safeguarding.
The so-called Arattai problem reminds us of the fact that not every messaging application is equal in terms of privacy. It serves as a reminder to all people that they need to know how their information is being processed and to use platforms that do care and keep their personal data safe and secure. The privacy cry is becoming deafening and businesses that do not react stand to lose at their own peril.
