Sex, Lies, or Kittens? Investigating the Use of Snapchat’s Self-Destructing Messages Franziska Roesner 1, Brian T. Gill 2, Tadayoshi Kohno 1 1 University of Washington, Computer Science & Engineering 2 Seattle Pacific University, Mathematics

Snapchat: Disappearing Messages 2 Official Snapchat screenshots ( As of late 2013: -350 million “snaps” per day. -Estimated over 30 million active users. -Attempted purchase by Facebook: $3B.

Snapchat: The Sexting App? 3 Research Question: How and for what do people really use Snapchat?

Snapchat: Not Actually Secure! Snapchat messages can be saved… (1)Via screenshots (sometimes secretly). (2)Retrieval after deletion. 4 Research Questions: -What are user’s screenshot practices and reactions? -Do people trust Snapchat, and does that affect use?

Our Research Questions 1.Usage Patterns: How and for what do people really use Snapchat? 2.Screenshot Practices: What are users’ screenshot practices and reactions? 3.Effect of Security Weaknesses: Do people trust Snapchat, and does that affect use? 5

Outline Background and Motivation User Survey Results Implications Summary 6

Outline Background and Motivation User Survey Results Implications Summary 7

User Survey 127 adult Snapchat users. (206 initial participants: 18 screened out for not knowing Snapchat, 61 for not using it.) Recruited via social media + university lists. Up to 41 questions, minutes. Limitations: adults, snowball sampling (high security expertise), multiple choice, possible under-reporting. 8

Demographics (1/2) 68.5% male, 29.9% female. Skewed towards younger adults: – 81.9% age – 14.2% age – 1.6% age – 0% age – 1.6% age

Demographics (2/2) Skewed towards higher security expertise (but no detected effect on most responses). 5% Novice % % % % Expert Westin Privacy Index: – 39% Privacy Fundamentalists – 46% Privacy Pragmatists – 13% Privacy Unconcerned 10

Our Research Questions 1.Usage Patterns: How and for what do people really use Snapchat? 2.Screenshot Practices: What are users’ screenshot practices and reactions? 3.Effect of Security Weaknesses: Do people trust Snapchat, and does that affect use? 11

(1) Usage Patterns Do respondents send sensitive content? Does message timeout behavior reflect privacy considerations? Do respondents use Snapchat for security and/or privacy reasons? 12

Sensitive Content? 13 Sending sensitive content is uncommon, though up to 25% may do so experimentally.

Useful for Non-Sensitive Content 14 “It lets me have more cats in my life because my friends who don’t normally post pictures of their cats on other social media will snapchat their cats to me.” “The fun of it is you can send a stupid face or a snapshot of what’s happening. The communication is compact and fast.” “There should be an option to recognize faces and add moustaches to those faces.”

Message Timeout Behavior 47.2% change timeout based on content/recipient. Shorter timeouts: – 22.8% for embarrassing photos. – 10.0% for secret information. – 10.0% for less trusted recipients. Longer timeouts: – 18.9% for more trusted recipients. – 9.4% (write-in) for complex content. 15

Why Snapchat? 46.5% use it because content is unlikely to be saved. Not necessarily for privacy reasons! 66.1% use it because it’s simple, 55.9% because it’s fun. 16 “Expectation of spam means it’s okay to spam.” “Some content, whether or not it’s risque, does not need to be seen more than once (e.g., photos of food).”

(2) Screenshot Practices How often do respondents take screenshots? How do respondents and their contacts react to screenshots? 17

Screenshot Behavior Screenshots are common: 47.2% report taking screenshots, 52.8% have had them taken. (3.9% have used a separate camera.) Most respondents don’t intend to violate trust, but 10.2% say they have taken a screenshot to embarrass the sender. 18 “We have a tacit agreement that if the timeout is 10sec, then a screenshot is almost expected.”

Screenshot Reactions 19 Screenshots are not usually a trust violation.

(3) Effect of Security Weaknesses Do respondents know that Snapchat message destruction is insecure? Do respondents report security-related behavior changes? Does lack of trust in Snapchat affect content respondents send? 20

Understanding (In)Security A majority of respondents understands that Snapchat is not secure: 79.5% know or suspect that recovering messages is possible. Only 14.1% “know” or think that message recovery is impossible. 21

Reported Behavior Changes 52.8% would not change their behavior in response to learning that Snapchat is insecure. 38.6% would change / have changed behavior: – 24.4% would use it differently. – 14.2% would use it less. 22

Observed Behavior Changes A majority of respondents is unwilling to send certain types of content via Snapchat: sexual, documents, legally questionable, mean/offensive/insulting. Why? Most because they “never take pictures of that sort of thing” (30.7 – 73.2%). The rest are concerned about Snapchat insecurity (up to 14.2%) and screenshots (up to 25.2%). 23

Outline Background and Motivation User Survey Results Implications Summary 24

Implications for Snapchat Misconception #1: Primarily for sensitive content. Misconception #2: Success threatened by vulnerabilities. Suggests: Snapchat should (and does) market itself differently. 25 Snapchat “has a bad reputation (for sexting).” “It seems useful only for inappropriate content.”

Implications for Secure Messaging A sizable fraction of respondents reported security-related behavior modifications. Suggests: Many users would still benefit from a more secure messaging application. 26 “I like the idea of Snapchat, but it definitely worries me that the photos are ‘out there’ somewhere, even if the snaps I’m sending don’t have sensitive content.”

Open Questions How do teenagers use Snapchat? How much did respondents under-report sensitive behaviors? How well do our survey results generalize to a broader population? Suggests: future, more behavioral studies of Snapchat needed. 27

Outline Background and Motivation User Survey Results Implications Summary 28

Summary Security and privacy in Snapchat are not major concerns for the majority of respondents. Most understand that message destruction is insecure. But: many have/would adapt behavior due to lack of trust or security issues. 29