Secure Mobile Messenger App Development

Summary

A European startup building privacy-focused communication apps wanted a messenger where messages are never stored on the server and cannot be decrypted by anyone but the chat participants. With no specification to start from, INNERLUXES designed the architecture and built a privacy-first Android app using RSA public-key encryption with client-side decryption, then layered on the features people expect from leading messengers — group chats, emoticons, tag-based public channels, and an encrypted personal cloud file store. The Android app was delivered in three months.

About the Client

The Client is a European startup offering secure communication applications for individuals and enterprises concerned about their privacy.

A Messenger Where the Server Can Never Read Your Messages

The Client commissioned INNERLUXES to create an app that would give users a safe, easy way to communicate and share voice messages, photos, videos, and other files. The central challenge was to ensure the highest level of security, so that messages would not be stored on the server and no one could decrypt them.

An Architecture-First Build Around Public-Key Encryption

Because the Client did not provide a specification, an INNERLUXES architect developed a high-level design, defining the components to build and the development tools best suited to the project. A pipeline architecture was chosen as a typical design pattern for real-time systems and messengers. The security and feature set were then built on that foundation:

• RSA public-key encryption — the algorithm uses a public key to encrypt messages and a secret decryption key kept on the client side (on the user's device), so only the chat participants can decode a message.
• Familiar messaging features — alongside image sharing, group chats, and emoticons, the app offers public channels for anonymous chatting on topics organized by tags, drawing on the best-of-breed features of leading messengers.
• Encrypted personal cloud storage — every user gets a personal cloud file store to upload and share files, with all files encrypted just like messages.
• Roadmap — INNERLUXES is extending the app with secure VoIP and voice messages.

An Android App Delivered in Three Months

• The Android-native app was completed in three months by a team of one architect, two senior PHP developers (backend), and two Android developers (frontend), with only a product owner on the Client's side.
• The Client is now planning iOS, Windows Phone, webchat, and desktop versions of the application with INNERLUXES.

Technologies and Tools

PHP, Symfony 2, phpDaemon, Nginx, Redis, Android SDK.