Clubhouse security and privacy - Is Clubhouse safe to use?
What is Clubhouse?
Launched in April 2020, Clubhouse is an audio-only social networking app. Essentially, users can listen in on conversations, interviews, and discussions between interesting people on various topics. Currently, the app is invitation-only – i.e., you have to be invited by existing users to join – although there are plans to make it more broadly available in the future.
Clubhouse has attracted a lot of media attention since it launched. This has been partly driven by the pandemic, which – with its emphasis on Zoom calls, etc. – led to 'video fatigue' and a corresponding interest in audio content instead. The invitation-only nature of the app, plus some high-profile celebrity users – including Elon Musk, Oprah Winfrey, Drake, Jared Leto, Tiffany Haddish, and others – has given it an exclusive aura that has also driven interest. With no text, videos, or likes, Clubhouse has been described as ‘the anti-Facebook’.
The app is free, designed for users aged 18 and above, and is currently only available on iOS. There are plans to make it available on Android. Despite being invitation-only, it has grown to around 2 million users, and this figure is rising. Like other social networking apps early on in their development, Clubhouse has attracted a range of privacy and security concerns.
How does Clubhouse work?
To join, users must be invited by an existing member. Each new sign-up can invite two new members to join. If you are invited, you receive a link texted to your mobile phone, which allows you to download the app. Clubhouse offers a waiting list, so if you don’t know an existing member, you can join the waiting list by downloading the app.
Once you’ve joined Clubhouse, you can create a bio and add a profile picture in a similar way to other social networking apps. You can also select your areas of interest, and the more information you give the app, the more recommendations it makes about individuals to follow or conversation rooms to join. There’s also an in-app calendar that allows you to see when rooms are active, enabling users to plan which conversations to join.
The app is primarily about listening. Users join conversation rooms that reflect their interests. By default, all users are muted, so you listen to the room’s administrator and speakers. If you want to speak, you can ‘raise your hand’ and, if the administrator allows, you can join the conversation.
You can also set up a conversation room of your own, which can be made public or private. This enables you to build a following of your own based on your interests or hold conversations with like-minded others.
Currently, only 5,000 people are allowed per conversation room – although, when Elon Musk gave a talk, this limit was raised, and fans also live-streamed his conversation on other Clubhouse rooms and via YouTube.
Conversation rooms come and go as people launch or end them. Clubhouse says it records conversations as they happen but only retains the recordings if someone files a complaint while the room is live. If no one reports an incident during the chat, Clubhouse says it discards the recording as soon as the host closes the discussion. However, users have found ways to record chats for their own purposes.
Clubhouse security issues
It’s not unusual for social networking apps, particularly relatively new ones, to be subject to privacy and security concerns. Clubhouse security issues include:
Clubhouse data breaches
In April 2020, a database containing 1.3 million Clubhouse user details leaked for free on a popular hacker forum. The information in the database included user IDs, names, profile photos, details of followers and those being followed, and – where users had linked their social media accounts – Twitter and Instagram user IDs. However, the breached data did not include passwords or email addresses, which would have been more damaging. That said, the leaked information could still have led to phishing or social engineering attacks.
Fake Clubhouse website
Cybercriminals often try to piggyback on the success of popular apps. In April 2021, cybercriminals created a fake Clubhouse website, which included a download link to a fake version of the app. When users downloaded the fake app, their device was infected with malware. Fortunately, this site was taken down relatively quickly. Because Clubhouse is currently available only for iOS, fake versions for Android began to spread. By installing such an application, the owner of a smartphone or tablet runs the risk of giving fraudsters access to an online bank, passwords from social networks, a contact list, as well as being bombarded with advertising banners.
Clubhouse back-end systems
Currently, Clubhouse uses a Chinese start-up called Agora to provide the back-end infrastructure for its app. This means that Agora could have access to users’ raw audio and other information. Because of Chinese cybersecurity laws, they could provide this information to the Chinese government if asked to do so.
Clubhouse privacy issues
Use of Clubhouse contacts
The invitation-only aspect of the app (which Clubhouse plans to change to make the app more widely available) raises a privacy concern. When you join the app, you are urged to give Clubhouse access to your phone’s contacts so that you can connect with other users of the social network. Without giving Clubhouse access to your phone contacts, you can’t invite others to join the app. Some users are concerned that Clubhouse may use that information to build profiles of potential users or for advertising purposes. This could potentially breach Europe’s General Data Protection (GDPR) law, which states that individuals must explicitly consent to share their data.
There is also no full-fledged account verification in Clubhouse, so anyone can impersonate a famous person if they wish. For example, users fell for the bait of a fake Brad Pitt.
There is no incognito mode in the application, and your every action on the social network leaves a trace. Moreover, the application interface does not even have a “Delete account” button and to start the procedure, you will have to send a written request to the support service.
The app aims to prevent users from recording conversations. Clubhouse itself temporarily records conversations in case a complaint is made about content that it might have to investigate. Clubhouse retains the recordings to investigate incidents and then deletes them when this is complete. If no complaints are made in real-time, Clubhouse says it deletes the temporary audio recording when the room ends.
One concern about this practice is that because the recorded audio is not end-to-end encrypted, it is potentially accessible by others. Also, conversations are recorded for as long as a room is occupied. This means that if you switch to another app without leaving the room, your microphone remains active and, therefore, potentially recordable.
A more severe criticism has been that your privacy on Clubhouse depends not just on your actions but also on the actions of anybody who has you as a contact. For example, suppose someone has your phone number in their contacts, and they've allowed Clubhouse to access those contacts. In that case, they will receive a notification when you join the app and a recommendation to follow you – even if you haven't given permission to share your own contacts with the app.
Clubhouse content moderation and avoiding inappropriate content
Clubhouse has attracted controversy with accusations of hate speech, conspiracy theories, and abuse taking place amongst its conversations, leading the app to update its content moderation guidelines. The app’s audio-only format presents a content moderation challenge since policing live audio is more challenging than using algorithms to detect offensive text-based comments. Clubhouse’s policy of retaining audio recordings of chats only if an incident is reported in real-time doesn’t help users who may want to report an offense after the event.
While the app is aimed at those aged 18 and above, there is no age checking or content filters in use. That’s important for parents to note since there are many adult-themed conversation rooms, and the app involves live chatting with strangers.
What happens when you block someone on Clubhouse?
You can avoid objectionable content on Clubhouse by blocking other users, which the app enables. When you block someone, they will neither see nor join a room you've created or one in which you're a moderator or speaker. However, when a blocked user is a speaker in a room you've joined, you can still see the room and even join in to speak or listen. Clubhouse offers a user safety guide that details its procedures for blocking other users and reporting incidents on the app.
The audio and live aspects of Clubhouse are key trends in social networking, which means the app is facing a range of competitors. These include:
- Instagram now allows people to turn off their video and mute themselves during Live Rooms, a feature that allows up to four people to chat and live broadcast together. This effectively creates an audio-only Live Room.
- Twitter has launched Spaces, allowing one person to start a live chat that speakers and participants can join.
- Facebook has launched Hotline, a web-based app that lets hosts chat to their audiences via audio and text.
- Chat app Telegram has a voice-chat feature that works in a similar way to Clubhouse's one-to-many dynamic.
- Discord offers Stages, where one speaker on a metaphorical ‘stage’ can speak to many people at once.
- Reddit offers Reddit Talk for hosting live audio conversations in Reddit communities.
- Fireside is launching in 2021 with a similar premise to Clubhouse but some key differences.
Is Clubhouse safe to use?
So, is Clubhouse safe? Like other apps before it, which have scaled rapidly in response to surging demand, Clubhouse has faced several security and privacy challenges. Newer apps are more likely to have security and privacy issues than mature, established ones. However, Clubhouse says it is deeply committed to data protection and user privacy and has identified areas where it can further strengthen data protection. The company also offers a bug bounty program in partnership with HackerOne, which rewards people who identify security vulnerabilities within the app so they can be addressed.
Compared to other popular social media apps, Clubhouse gathers less information about its users. For example, it doesn't use iPhone location services and only has a rough estimate of your location based on your IP address. As an audio-only app, it doesn’t request access to your camera or photos.
As a medium, audio-only apps are likely to be around for a while. An important way to stay safe when using your mobile phone is through antivirus protection. For example, Kaspersky Internet Protection for Android blocks suspicious apps, websites, and files and uses machine learning to combat new threats.