Messaging App Development

Mobile apps have opened up a wide range of opportunities for businesses, including new avenues for promotion and sales. However, each new frontier brings about new threats; application hacking, information leakage, and loss of reputation are all things that businesses must be aware of when populating the sphere of mobile apps. In 2022, the global economy lost $6 trillion to cybercrime. This amount factors in losses caused by the theft of data and intellectual property, as well as the disruption of business operations.

Confidentiality is the hottest topic of the mobile internet age. Reports of security breaches due to software flaws are published daily — we have seen that even the messaging apps of tech giants aren’t immune to hackers. Both negligent database maintenance and the use of weak passwords are to blame. Given these less-than-ideal circumstances, the demand for the development of encrypted messaging apps is on the rise.

Operation principles of secure and standard messaging apps

At least half of the world is using messaging apps. WhatsApp and Facebook Messenger alone have 2 billion and 1.3 billion active users respectively. More people are beginning to wonder — how safe is it to use these apps when discussing confidential topics?

Most popular messaging apps are based on two messaging protocols:

1. HTTP + push notifications. Here you are notified of a new message, and the server will only respond to you after you open the application.
2. Extensible Messaging and Presence Protocol (XMPP). Here you are always connected to the server, and if the connection is lost, you will be switched to an offline mode.

Many messaging apps have weaknesses that pose cybersecurity threats. Attackers are more attracted to applications that deal with confidential data, as they can use this data against users or companies carrying out private or corporate correspondence. Therefore, any information in message exchanges, be it text, image, or video, must be reliably protected.

Each messaging app uses its own securitisation methods, but the main difference between secure and standard messaging apps is data encryption. Secure applications have become a separate category as awareness of the vulnerability of online communication to third party access has grown. There have been many cases in which large companies have used user data, including private messages, for targeted advertising.

End-to-end encryption

The basic principle of secure messaging is end-to-end encryption. It uses a multilevel approach that makes penetration of correspondences with access to data particularly difficult. End-to-end encryption works like this:

• Two users start a conversation. This event generates two keys: a private key (which remains on the user’s device) and a public key (which is stored on the service provider’s server).
• When the first user writes a message, the public key encrypts it so that the message can only be read with the private key. Then the server sends the message to the second user, who decrypts it with their private key.

In this system, the data stored on the server is useless in its encrypted form. It appears as a string of letters and numbers that is incomprehensible without the private key. Meanwhile, the private key is invincible to decryption — its randomly generated characters are unrelated to the public key. If the attacker can’t obtain the private key directly from the user’s device, then the probability of accessing the encrypted correspondence is 0.

For example, the messaging app Signal runs on the cryptographic protocol of the same name developed by Open Whisper Systems for their first application (TextSecure). Signal Protocol is also used by default in WhatsApp and as an additional feature in Facebook Messenger and Skype.

Deleting messages

Automatic deletion of messages is another important piece of the puzzle. Although many messaging apps have this function, there is no guarantee that messages are actually deleted from application servers and databases. For example, Meta and Google are known to store user messages. We can only hope that not all service providers are so ‘thrifty.’ Those who allow messages to be automatically deleted are trying to build trusting relationships with users.

Using metadata

Metadata is also problematic when it comes to respecting users’ privacy. Most messaging apps store metadata such as message time, sender and recipient, contact list, and device identifier, which can then be used to identify the users themselves. One popular messaging app that is known to store metadata is WhatsApp. Hackers could theoretically use this to identify the user and apply social engineering to get the decryption key.

Transparency and openness

Transparency for secure messaging apps sounds twofold. On the one hand, you should state certain terms of service confirming your intention to provide users with a confidential and secure platform. This means that correspondence and user data should be private, not openly accessible. On the other hand, a truly secure application should have open-source code available for any auditor to review. It’s also an easy way to improve the quality of an application by allowing enthusiastic programmers to test it for free.

As a result, the security of a messaging app is based on 4 principles:

1. End-to-end encryption.
2. Automatic deletion of messages.
3. Limited use of metadata.
4. Transparency of the service and openness of the code.

Polygant specialists are ready to develop the terms of reference for an information security system, incorporating all 4 of the aforementioned principles.

Messaging app popularity statistics

According to statistics on monthly active users, WhatsApp is the leading messaging app in 169 countries. In 25 countries it lost its leading position to rival messaging apps, primarily Facebook Messenger, which ranks first in 15 countries. In the remaining 10 countries, messaging apps that don’t belong to Meta are more popular.

Since the market is so globalised, let’s focus on some particulars. This is what the global messaging app ranking looks like now:

The number of monthly active users is indicated in millions, data from Statista as of January 2023.

And here are the top 3 messaging apps in individual countries:

Country	1st place	2nd place	3rd place
The United Kingdom	WhatsApp	Snapchat	Telegram
The United States	WhatsApp	Facebook Messenger	Snapchat
Canada	WhatsApp	Snapchat	Telegram
Russia	Telegram	WhatsApp	Snapchat

The places are based on Google Play rankings, data from Similarweb as of May 2023.

Popular encrypted messaging apps

As a rule, rankings don’t factor in individual application features (protocols, functions, etc.) and often don’t distinguish between secure and standard messaging apps. Therefore, for greater integrity and topical relevance, we would like to list the most secure messaging apps, i.e. those using end-to-end encryption.

The best messaging apps with end-to-end encryption according to TechRadar as of November 2022:

1. Element.io.
2. Signal.
3. WhatsApp.
4. Telegram.
5. Threema.

The best messaging apps with end-to-end encryption according to TechRadar as of May 2023:

1. Signal.
2. Telegram.
3. WhatsApp.
4. Threema.
5. Wire.

We hope that your future encrypted messaging app will be included in one of these rankings someday. To get started with the process of developing a messaging app, contact us on Telegram.

Creating a blockchain messaging app: mission impossible

Many people have heard about blockchain technology and are trying to implement it anywhere and everywhere. However, even this technology isn’t a panacea for all business interests — it can’t secure absolutely everything, reduce costs, and increase revenue at the same time.

In theory, the blockchain has many potential applications, but in practice, it has only tangible benefits in financial services, trade, and production industries. When it comes to secure messaging apps, there are two major obstacles to its implementation.

Blockchain needs storage space

The first obstacle will be the storage for everything that accompanies sent and received messages. Gone are the days when a message was only plain text. Today it often contains photos, voice messages, videos, and documents. All of this requires storage space, which users of non-blockchain applications don’t have to consider.

Where to store messages when creating a blockchain messaging app? After all, it will need full nodes with a synchronised copy of the ledger. This will either have been the messaging app owner’s servers or users’ individual devices. Would users want to store gigabytes of extraneous information in their devices? This is a considerable amount of data for smartphone users especially, whose devices have only 32–256 GB of internal memory. Compare it with the following: in May 2023, Bitcoin’s blockchain size reached 483 GB, and Ethereum’s reached 986 GB. This is only transaction information; no photos, audios, or videos. You will have to somehow incentivise network participants to maintain blockchain functioning.

There’s also an inherent conflict of interest when it comes to using blockchain. It will store either all messages (including attachments) or metadata without the option of deletion. This would violate two of the four principles on which messaging app security is built.

Blockchain needs validators

The second obstacle will be the consensus algorithm, which is necessary for any blockchain to create trust between network participants. It’s not enough to distribute the ledger to thousands of devices for storing information. Some of them must constantly validate user actions before adding entries to the block. For example, in P2P payment systems, such actions are cryptocurrency transactions. Miners, stakers, or delegates charge a commission for validating transactions; they receive a reward for adding a block to the chain. Otherwise, it makes no sense for them to maintain a network.

If you want to create a secure messaging app on the blockchain, then be ready to create incentives for validators. This way, they will contribute their resources and time to validate messages passing through the network. You will also have to involve tokenomics where it wasn’t previously needed. Everything is interconnected: without payment for actions there will be no validators, without validators there will be no trust, without trust there will be no users.

At the same time, these main participants of the network will become its bottleneck. If there are too little of them, or if the number of operations per second is peak for the network, then they won’t have time to validate user actions. This will lead to severe delays.

Consider Ethereum: on average, a transaction is validated in 12 seconds — that’s the time needed to create a block. In 2023, about 12 transactions per second are carried out through the network (without delays); the maximum for all time is 22 transactions per second (with delays). The limit for a block turns out to be: 22 × 12 s. = 264 transactions. Anything that exceeds it will queue up for the next blocks. Compare this with WhatsApp: in 2023, over 1 million messages per second are sent through it. If WhatsApp ran on the Ethereum blockchain, then users would be queued up to create 3787 blocks that could contain a million messages. So, it would take: 3787 × 12 s. = 45,444 seconds, or 12.6 hours, to deliver one message.

Finally, there is still a violation of the principles of protecting privacy for secure messaging apps: hundreds of validators and thousands of other network participants will have access to message metadata. Privacy lovers are concerned when a single company like Meta owns their data — in the case of blockchain, the whole network will know when and to whom their messages are sent.

What features a secure messaging app should offer users

Registration by phone number

Convenience should come first. Since usage begins with registration, it should be simplified so that people don’t have to remember a lot of credentials in order to log in to the application. You shouldn’t request an email, because it is easier for attackers to gain access to it than to a SIM card.

Deleting messages and accounts

A secure messaging app should have a function for deleting messages. It usually allows users to enable deletion of messages after a specified time in minutes, days, or weeks. The same goes for deletion of accounts: if the user hasn’t logged in to the application for a certain time, let the account be deleted along with all the dialogues and data.

Group chats

Users need the ability to create private group chats where they can conduct encrypted conversations. For example, personal chats with family and friends, or business chats with colleagues and partners. The application server shouldn’t have access to any group metadata.

Sharing content

Any messaging app should have a function for transferring images, audios, videos, and documents. This also applies to secure messaging apps. However, in the app settings, there should be an option not to save sent and received files or to automatically delete them from the default folder.

What opportunities a secure messenger brings to a business

In business operations, communication has become an important element in maintaining an efficient and dynamic workflow. Since businessmen and their employees are loaded with many tasks, messaging applications have become their main assistants. However, just as they can help, they can do much harm.

The flow of information on the Internet is always controlled by someone. Data is transmitted through servers from point A to point B and beyond. Communication via a messaging application relies on a third-party service provider. Although the terms of service assume that all user data is considered confidential and therefore untouchable, this data is available to the service provider. This means that theoretically they can be used for purposes other than storing information since users accept the terms of the agreement. And people usually do not read the terms or do not notice the cunning wording where the service representative disclaims responsibility for data confidentiality.

It turns out that using some messaging applications is unsafe: the service provider may be unreliable. It is one thing when the user compromises, and quite another when the service is compromised. Businessmen should not risk their confidential information.

In this case, your own encrypted messaging app will solve the problem of protecting your data during communication. You can make the application private: registration will be available only at the invitation of an existing user or a specific person. You will store data on your server, and you will be able to completely delete it at any time. You will control the information flow in your messaging application.

How much it costs to develop a messaging app

Developing a messaging app is a time-consuming process. Here you can’t hire low-cost freelancers and get the job done in a few days. The back end for such an application has a myriad of unique challenges which demand a competent approach. Otherwise, you risk exceeding your budget and development time frame. Much will also depend on the technology stack used and the features being implemented.

Only a qualified team of developers and testers can handle the development of a corporate messaging app. They will ensure that all communication on the app is kept confidential and that no information transmitted ends up in the wrong hands.

If you are looking to create a messaging app for the whole world, rather than an exclusive set of users, then a much more rigorous plan must be put in place. In order for your app to get noticed amongst competitors, it will need a unique model, a friendly user interface, and a well-developed marketing plan.

The creation of a messaging app from scratch consists of the following stages:

1. Writing terms of reference (if you don’t have them) — 50+ hours.
2. Business analysis and specification — 40+ hours.
3. UI and UX design — approximately 150 hours.
4. Developing a back end — 500+ hours, depending on the required functionality of the application and the number of platforms.
5. Developing a mobile messaging app — 320+ hours.
6. Testing — approximately 250 hours, depending on the number of platforms and functionality.

Based on this data, the cost of an MVP of the application starts at $50,000. The actual cost may be greater, depending on factors that complicate the work. You should also take into account in advance that after creating a secure messaging app, it needs to be maintained. This includes correcting possible errors, refining old functions and implementing new ones. These services are provided at additional cost.

Polygant has been developing mobile messaging apps for 10 years. When creating unique secure applications, we prioritise the customer’s vision and adapt to the specific needs of their field. Send a request and after a detailed consultation, we will get started on your project right away!