Rakuten Viber’s Approach to Balancing Encryption and User Safety

In an interview, Liad Shnell, CISO and CTO at Rakuten Viber, highlighted how messaging platforms like Viber have become essential during crises, serving as critical infrastructure for users. With hundreds of millions relying on Viber for communication during emergencies, the platform prioritizes security measures that ensure availability, integrity, and abuse resilience alongside confidentiality.

Shnell explained that Viber has had end-to-end encryption enabled by default since version 6.0, raising challenges in addressing issues like child exploitation and large-scale fraud. The platform’s security strategy incorporates automation and real-time detection to manage risks associated with account takeovers, impersonation, and social engineering.

Viber’s approach to scams and social engineering acknowledges the interplay between technology and human behavior. The platform designs defenses that guide users towards safer behaviors without overwhelming them with security warnings. This includes features that alert users when unknown contacts reach out and allow them to control group invitations.

Incident response for Viber is tailored to address influence operations rather than traditional data breaches. Shnell emphasized the need for rapid response and decision-making under uncertainty, especially in scenarios involving deepfake media and coordinated narratives that can undermine user trust.

When assessing security, Viber focuses on metrics that reflect user harm, such as account takeover rates and the effectiveness of scam mitigation, rather than vanity metrics like total blocked messages. This user-centric approach aims to reduce harm and maintain trust in the platform.

Key Security Metrics for Messaging Platforms

Shnell pointed out that misleading metrics often include total attacks stopped, which may not accurately reflect user safety. Instead, Viber prioritizes metrics that indicate real-world resilience and user recovery speed, ensuring that security measures effectively protect users.

• End-to-End Encryption: Viber has enabled this feature by default since version 6.0, enhancing user privacy.
• Account Takeover: A significant threat that Viber addresses through embedded security controls.
• Impersonation: Viber recognizes this as a high-impact security incident with real-world consequences.
• Social Engineering: Viber designs defenses to combat scams that exploit human trust.
• Incident Response: Viber’s strategy focuses on rapid response to influence operations rather than traditional data breaches.