21–30 of 43 posts
I would still stay away from Facebook even with this. That platform is a data miner. Nothing more, nothing less.
Data mining is the price you pay to have those things for free. I'll leave it up to individuals to decide whether or not it's worth the cost.
Still, it's a fun proof of concept tool.
I bet Facebook gets a lot more value out of tracking you across services and locations than from the actual contents of your messages. This doesn't address it; if you're willing to go to these lengths, just switch to another platform that encrypts E2E.
Earlier quoted context omitted.
This is whitepaper, it is not implementation of closed source application. Let me explain how this works in PR world. You publish (with all the bells and whistles) that you have end to end encryption and explain protocol that uses asymmetric cryptography (just for the sake of simplicity I will simplify - you have public and private key, you send public key to all chatters with you, they will encrypt randomly generate…
Your speculation is not interesting to me. What is interesting to me are actual bugs and vulnerabilities that credible people have found and gotten fixed: https://link.springer.com/chapter/10.1007/978-3-319-63697-9_...
e.g. https://www.cnet.com/news/facebook-bug-has-camera-activated-...
Where the question arises: was it a bug that the camera was on, or that it was revealed inadvertently? Hence the discussion of trust in the client. That is an instance where Facebook lost some of that trust "in buckets".
It's true that "shit happens", but when it "happens" reptitively the questions begin to emerge. I don't think that's unfair. I mean, I'm sure few people would use a stock Ford Pinto as their regular driver, regardless of Ford's intentions or engineering capabilities.
Earlier quoted context omitted.
but it is a safe assumption
It's a falsifiable assumption. Audit the binaries if you want to convince yourself. You will see code to generate and use keys locally, with no mechanism to fetch or share keys from a server. If you want to go beyond generic concerns, there are plenty of academic papers that have looked at Facebook Secret Conversations, found actual issues, and helped get them fixed: https://link.springer.com/article/10.1007/s00145-0…
This is Facebook, for pete's sake. The same company that conducted psychological experiments with zero clinical/ethical oversight by manipulating its users' feeds to see if it could cause depression/anxiety (or the opposite).
Facebook is evil and you should not trust them even a little bit.
Facebook Messenger already has Secret Conversations, which is end-to-end encrypted mode based on the Signal protocol. Here's the technical whitepaper: https://about.fb.com/wp-content/uploads/2016/07/messenger-se... Here's some of the academic work on messaging franking that it has driven: https://eprint.iacr.org/2017/664.pdf Here's the instructions how to use it: https://www.facebook.com/help/messenger-app/1084673321…
If we chat and then shortly there after you search for some fringe political group, it's pretty safe to see that as a strong indication that I'm involved with that group. Or if my geolocation places me at some political event and we chat during or just after it, you're implicated.
FB doesn't need the contents of messages, they need the metadata plus all the other user tracking.
Earlier quoted context omitted.
but it is a safe assumption
It's a falsifiable assumption. Audit the binaries if you want to convince yourself. You will see code to generate and use keys locally, with no mechanism to fetch or share keys from a server. If you want to go beyond generic concerns, there are plenty of academic papers that have looked at Facebook Secret Conversations, found actual issues, and helped get them fixed: https://link.springer.com/article/10.1007/s00145-0…
Earlier quoted context omitted.
This is whitepaper, it is not implementation of closed source application. Let me explain how this works in PR world. You publish (with all the bells and whistles) that you have end to end encryption and explain protocol that uses asymmetric cryptography (just for the sake of simplicity I will simplify - you have public and private key, you send public key to all chatters with you, they will encrypt randomly generate…
Your speculation is not interesting to me. What is interesting to me are actual bugs and vulnerabilities that credible people have found and gotten fixed: https://link.springer.com/chapter/10.1007/978-3-319-63697-9_...