Many say that the contact list import procedure is yet another weak spot in messaging app security and in personal data security in general. While we decided that our app would certainly have to have this useful function, it will need to be implemented in a way that gives users maximum protection.
To make it work, we had to develop a solution that reconciles two conflicting approaches. On the one hand, we decided not to store contacts on servers because that’s where data leaks usually occur, and we were determined to eliminate even the slightest possibility, despite all the encryption we apply. On the other hand though, we also agree that it would be really helpful for users when importing contacts to see who among them is also using Aegees, and you can’t do that without accessing the data!
In the end, this is what we came up with to implement both these requirements successfully:
• Each user will decide if they want to import contacts and make their own contact data searchable by other users;
• The data necessary for these two operations will be encrypted at all times while being stored and handled on servers. The client app will receive server-issued notifications and inform of other known Aegees users found on the contact list.
This solution will allow users to make up their own minds about whether they want to remain anonymous or share their details while at the same time, protecting their data on servers.