Privacy Implications

In this section, we analyze the users’ privacy implications from using WhatsApp, Telegram, and Discord. When dealing with social media platforms, a common concern is about privacy and exposure of sensitive personally identifiable information (PII). In particular, for messaging platforms where users are engaged in direct and closed

conver-5We only refer to the country with which a member’s phone is associated, and we cannot readily infer their nationality.

6<https://blog.whatsapp.com/10000653/Introducing-Stickers>

6.1. Comparing Groups from Different Instant Messaging Platforms 100 Table 6.5: Statistics on users’ sensitive PII that are exposed from the three messaging plat-forms.

WhatsApp Telegram Discord Users observed 20,906 members

74,479 members 25,701 members 34,078 creators

Users’ Phone Numbers 54,984 (100%) 509 (0.68%)

-Users’ Social Networks - - 7,708 (30%)

Table 6.6: Number and percentage of Discord users whose their accounts on other platforms are exposed.

Platform #Users (%) Twitch 5,256 (20.4%)

Steam 3,158 (12.2%)

Twitter 2,287 (8.9%) Spotify 2,080 (8.0%) YouTube 1,712 (6.6%) Battlenet 1,338 (5.2%)

Xbox 956 (3.7%)

Reddit 785 (3.0%)

League of Legends 617 (2.4%)

Skype 169 (0.6%)

Facebook 139 (0.5%)

sations in a private and secure manner, it is important to analyze the potential PII that can be exposed by the platform.

Usually, users are joining these groups while being fully agnostic that various as-pects of their private information are exposed by either the platforms’ interfaces or their APIs. This raises some legitimate concerns regarding what kind of PII is exposed by each platform, and how critical and prevalent is the exposure of PII on WhatsApp, Telegram, and Discord. To this end, we collect all user-related information from each messaging platform and analyze them to understand the underlying privacy implications from the use of messaging platforms.

Each of the messaging platforms has its own peculiarities, and it requires a different approach to collect user information. On Telegram and Discord, we are able to collect user information for users that participate in groups that we also are members of. This also applies for WhatsApp, however, there is an important difference as WhatsApp exposes the phone number of group creators even before joining WhatsApp groups. To collect data related to users, for Telegram and Discord we used the available APIs to get user information for groups we joined, while for WhatsApp we scraped the information from all discovered groups.

Table 6.5 reports the number of users whose PII are exposed for each messaging platform. Looking at the total number of users which we collected data, we find 20,906 WhatsApp users within the groups we joined, and 34,078 unique users that are the creators of the rest of the groups that are accessible, totaling 54,984 users. Notably, WhatsApp

6.1. Comparing Groups from Different Instant Messaging Platforms 101 not only displays the phone number of all members of the groups we joined, but also reveals the phone number of the groups’ creators to non-members of the group. Those 34k phone can be accessed without the necessity of join groups. Only parsing the URLs of invite links on Twitter was enough to get the number of the creator of the groups

For Telegram, we collect information for 74,479 users, while for Discord we find 25,701 users. Note that for Telegram and Discord, the number of users is smaller than the total of users for groups we joined, representing 10.8% and 49% for Telegram and Discord, respectively. This is because on Telegram, administrators are able to restrict the access to the member list, and thus users can not see who are the members of the group.

For Discord, the API blocks bots to join groups by themselves (they need to be added by an administrator) and obtain the list of members. Due to these constraints, we collect user information for users who posted at least one message within the groups we joined.

WhatsApp, on the other hand, has easy direct access to all other members by the member list of the groups. As Telegram and Discord provides official APIs to manage groups and do tasks, it was possible to get information from the observed users regarding whether the user is a bot or not. We found some bots among the users (53 on Telegram and 102 on Discord), and even that it represents less than 1% of the total of users, considering that we joined exactly a hundred groups for each platform, the number of bots per group is likely to be high.

Our data collection and analysis highlights the exposure of PII information in each platform. Alarmingly, on WhatsApp we are able to obtain the phone number ofall users that we discovered during our data collection, a total of 54,498 phone numbers. On the other hand, on Telegram we can only obtain the phone numbers of 509 users, which corresponds to 0.68% of all the Telegram users who participated in the groups we joined.

The relatively low percentage is because Telegram hides the phone number of the users by default. A phone number is only shown within the platform if the user explicitly opts-in.

Finally, for Discord, since phone numbers are not required for registration, we find no evidence of phone number exposure. However, we find that Discord exposes accounts that users have on other platforms: we find 7,708 users (30%) for who we are able to obtain at least one other account that they have on other platforms, namely, Twitch, Steam, Twitter, Spotify, YouTube, Battlenet, Xbox, Reddit, League of Legends, Skype, and Facebook. Table 6.6 reports the number of users whose users’ accounts are exposed for each of the other linked platforms. Since Discord is a gaming-oriented platform, some of their social networks are related to game universe, like the Twitch, the platform in which Discord users had more linked their accounts (20.45%), that is a streamer platform to gamers share their gameplays, and Steam (12.29%), that is a widely known video game digital distribution service. It is important to highlight also the high presence of accounts of Twitter(8.9%), YouTube (6.66%), and Facebook(0.54%), that can be considered very high sensitive PII information. Our analysis shows that Discord exposes at least one social

6.1. Comparing Groups from Different Instant Messaging Platforms 102 media account for 30% of the Discord users monitored.

Overall, these findings have important implications to user’s privacy. The exposure of PII from all these messaging platforms can be potentially exploited by malevolent actors that aim to target users. For instance, state-sponsored actors (ZANNETTOU et al., 2019a, 2019b) that have considerable resources and can perform a much larger data collection than our study, can create profiles for all those users and target them on the same or on other social media platforms. A potential attack vector is the creation of user profiles based on the topics of the groups they participate and then their targeting on other social media platforms via posts or advertisements with the goal to manipulate them or change their ideology. Also, our results highlight the need to raise user awareness about the privacy implications from the use of messaging platforms like WhatsApp, Telegram, and Discord.