Is Keepsafe Safe? A Security Analysis of the Popular Encrypted Photo Locker

There are countless apps claiming to protect your most personal and intimate media through encrypted photo storage, and one of the most prominent is Keepsafe. Keepsafe has been around for over a decade: the first version of their Android app launched in June 2011, with the iOS version released the following year in April. They were part of a new category of popular hidden photo apps, filling the need that people had to secure private photos on their mobile devices. While Keepsafe may be the market leader in the photo vault category, you have to ask yourself before using it: is Keepsafe safe and truly secure?

As iOS developers and the founders of Encamera, a privacy-focused encrypted photo vault app, we have a vested interest in exploring the security features of other apps in the marketplace. What we discovered about Keepsafe's capabilities to access your private data may surprise you, and that's what we want to discuss in this post. We'll be focusing on their iOS app, since that is our area of expertise.

Before We Begin

If you're keen to follow along and verify some of the things we've verified ourselves, we used a couple of command-line tools to do this. We used IPATool to download the app from the App Store, and dsdump to investigate the class and method names in the app binary. To investigate the network traffic, we used Charles Proxy. A disclaimer: we're not security researchers, just iOS engineers who know how to peek inside iOS apps. This investigation was done in May 2023, and it's possible that if you're reading this later on, things have changed.

Data Collection by Keepsafe's Photo Vault

In order to use Keepsafe's hidden photo app, you must enter your name and email address. For us, this is an immediate privacy concern, as it associates your identity with an account on Keepsafe, making it possible for hackers to personally target you if they already have your email address. Of course, there are ways around this that will increase your privacy, such as using the "Hide my Email" iCloud functionality, which we would definitely recommend using if you choose this photo locker.

Digging a little deeper into the technical side of things, we can open the app package and see that Keepsafe is using Amplitude in some capacity, which is a tracking and analytics platform. However, because they have an extra layer of security enabled on their tracker (certificate pinning) when sending tracking data, we were not able to view the data that was sent to their servers using our proxy, but we could see that it was calling out quite frequently when interacting with the app. It's probably mostly sending data about where you tapped, etc. Amplitude says that they may share data with third parties, and their policies are pretty standard for the user tracking category of businesses.

Keepsafe Can Access Your Encrypted Photos

This is nothing secret—they are very open about this, and it even says so on their website. Now, we're sure the circumstances would have to be extraordinary for Keepsafe staff to be compelled to open your hidden photos, either by law enforcement or otherwise, and we're not trying to cast doubt on their intentions to deliver on their promise of security. However, if they have this capability to decrypt and view your photos, that means malicious actors could potentially gain access to this ability as well. This includes both hackers and compromised staff members inside their organization.

Though Keepsafe has promised that security is their highest priority, big names like Uber, Twitter, and WhatsApp had serious data breaches where people's personal information was exposed. Uber even tried to cover up one of their data breaches (they have had a few), and their chief security officer was recently sentenced to three years probation and ordered to pay a $50K fine for this coverup.

Keepsafe would certainly be a target for hackers, and if they were able to successfully breach their defenses, every user's security would be compromised. You also need to trust that a report would be released saying that Keepsafe has been compromised, instead of trying to sweep it under the rug like Uber tried to. We're sure Keepsafe has the best intentions and have amazing security engineers on staff with top-of-the-line protocols, but something tells us that Uber and Twitter would have claimed the same.

Potential Use of AI for NSFW Content Detection

This was a surprise to us. Inside the app bundle, which is what's downloaded to your phone from the App Store, there exists a file named "nsfw.mlmodelc". This file is an Apple ML Model, designed to be used by Apple's Vision Framework to detect images that it has been trained on. These models are used on the device to provide instant recognition of objects that match what the model can recognize.

NSFW data model in Finder

Given the name of the model, we think it's probably been trained to identify some private content. Having a further look into the app binary, we can see that there is code that uses this ML model. Below is a screenshot of the compiled code, with the method names extracted.

The line you see above corresponds to a method called IntelligentImporter.getNsfwScore(from:). Just to be clear, we don't have the source code to Keepsafe—this information is included with the app you download from the App Store. Because we don't have the source code, we can only speculate about how this data model is used. Because this code exists, it definitely invites the possibility that Keepsafe is analyzing your hidden photos to check for NSFW content. Maybe they are doing this to get a better idea of what their users are storing, perhaps for market research? It's impossible to say for sure without seeing the code.

If this AI model exists in the app along with the method names we found, it means your personal images are capable of being analyzed, which might make some users of this photo vault uncomfortable. It could be that this type of analysis is warranted in their terms of service, and that they have the right given by you when agreeing to their terms of service. We still think it's a concern given that they have full access to your encrypted photos on their servers and could decide to view your photos at any time.

Is Keepsafe Encrypted and Secure?

Keepsafe seems genuinely committed to keeping your media safe, and we really don't doubt that commitment. They choose ad providers that are more privacy-focused, and they communicate that they do not reveal your data unless for legal or safety reasons. However, the fact still stands that they can view your photos, and you need to consider that if you decide to use this photo locker app. Whether or not the AI they ship with the app is a threat to your privacy is unclear—you should simply take that information into consideration when making your decision. No matter how strong the encryption is that a service is using, if they have the ability to look at your photos, it means there are human beings ultimately deciding what is kept secret.

An Alternative Encrypted Photo Vault: Encamera

We believe that privacy apps should have zero knowledge about what is being stored. When we discovered that most secret photo vault apps like Keepsafe use their own cloud storage and keep data on their servers, we were motivated to build our own encrypted photo locker. This is why we built Encamera.

How is Encamera's Encrypted Photo Storage Different?

Encamera is different than Keepsafe because it is a standalone hidden photo app that lets you store your media encrypted on your own iCloud or locally on your device. Your photos are encrypted using industry-standard encryption, and without your private key, it's impossible for anyone—including us—to view your hidden photos. You control where your data goes, and when you delete it, it's really gone. There isn't any user-specific tracking or ads in the app, and it's got a better design than most photo vault apps out there.

We do some behavior tracking, but it's only to measure how people are liking the features we implement so we can improve the encrypted photo locker, and it's anonymous. Many people don't like subscriptions, so you can even purchase a one-time license if you'd like. If you're looking for an alternative to Keepsafe or other photo vault apps with true encrypted photo storage, we hope you'll give Encamera a try.

We think it's important that people have the ability to have somewhere they can keep photos they don't want other people to see, and to have confidence that their data is safe. With Encamera's encryption, your private photos remain completely inaccessible without your private key—even to us. We have open-sourced the core functionality to help gain your trust and to be transparent with the functionality. All the encryption functionality, storage code, and keychain access code is in that library for the world to see.

Try Encamera's Encrypted Photo Vault for Free

If you value your privacy and want full control over your personal photos with genuine end-to-end encryption, we invite you to try Encamera for free. You can add 10 photos or videos before upgrading. After that, you'll need a premium subscription to continue using this secure photo locker.

Conclusion: Choosing the Right Photo Vault for Your Hidden Photos

In doing the research for this post, we did not expect to find what we did. Our original goal was to write a piece that pointed out that Keepsafe collects your data and can view your encrypted photos, because they say that on their website and we believe that's not obvious for most people. But to find the data model that gives Keepsafe the capability to analyze your hidden photos was a surprise.

Our hope is that Keepsafe would be more transparent about their practices, so this wouldn't be a surprise to people who are concerned about their privacy. We hope we have done well to explain the topics and educate you a bit about this massively popular photo vault app. When choosing an encrypted photo locker, remember that true privacy means your photos are encrypted with a private key that only you control—not the company storing them.

If you have feedback or comments, feel free to contact us at info@encamera.app.

Thanks for reading!

- The Encamera Team