This is worse than useless as it doesn't encrypt browser initiated messages and doesn't work cross device. It's yet another attempt to force FB users to switch to the very shady FB Messenger app. I'm still not touching it with a ten foot pole.
Facebook Messenger begins testing end-to-end encryption using Signal Protocol
51–60 of 312 posts
Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol
#52Earlier quoted context omitted.
Device to device. As you are aware, doing this in a browser in a manner that is not begging for failure is next to impossible.
Could you elaborate on why applying signal protocal in a browser is next to impossible?
Because if you serve the library responsible for the encryption from the server, an attacker can perform a man in the middle attack and change that library. This will change when browsers will start implementing the web crypto api. https://www.w3.org/TR/WebCryptoAPI/
Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol
#53Earlier quoted context omitted.
Device to device. As you are aware, doing this in a browser in a manner that is not begging for failure is next to impossible.
Could you elaborate on why applying signal protocal in a browser is next to impossible?
Well, the keywords there are next to. Like @remy_ implied, you need a mechanism for guaranteeing that the logic you're executing in-browser is protected from server compromise. That's where the Cyph example came in, since as far as I can tell, Cyph is the team to have hacked together a solution to that dilemma, though Cyph also is not using the Signal Protocol right now.
Anyway, there's an upcoming defcon talk which'll lightly touch on how web standards were mangled and viciously abused to make that happen, but since the talk is deliberately not vendor-specific, the focus on it will be brief. Disclaimer on my end is that I was involved in the initial review of their code-signing implementation. https://www.defcon.org/html/defcon-24/dc-24-speakers.html#Za...
Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol
#54How can I verify my device is indeed running the signal protocol? Messenger is a proprietary app.
Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol
#55I'm really skeptical about this. First of all, Facebook collects more user data than just about any company out there. They make most of their money off of advertising and harvesting user data and metadata. Facebook is just about the last company I'd trust to encrypt data of mine. It's like them saying, "hey, I know we make most of our revenue off of collecting user data but I think we should throw away a huge portio…
It is opt in because there is a huge base of users who use Messenger via the web, and trying to do E2E in that environment is a fool's errand. If you had ever tried to deliver a crypto improvement to an actual shipping product I am sure you would know what sort of limitations one needs to operate within, but please feel free to continue risking other people's lives for the sake of feeling smug in your ignorant dismissal of this effort.
Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol
#56Earlier quoted context omitted.
Could you elaborate on why applying signal protocal in a browser is next to impossible?
Because if you serve the library responsible for the encryption from the server, an attacker can perform a man in the middle attack and change that library. This will change when browsers will start implementing the web crypto api. https://www.w3.org/TR/WebCryptoAPI/
The concern is less MITM and more a compromise of the server, but close enough. Check my parallel response to Omnipresent's comment.
Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol
#57As much as this is a step in the right direction, you have to specifically enable encryption for individual conversations in Messenger. This implementation seems a little sketchy to me. They really should just encrypt every conversation automatically. Otherwise, encryption only encourages scrutiny.
Til they have cross-device key sharing, that default would frustrate most of their user base. I'm not sure why they haven't implemented cross-device key share though, maybe it's hard for web?
Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol
#58Reasons from not enabling it by default by @alexstamos (CSO @ Facebook): - FBM is multi-device, and we'd like to see E2E usability improve to support this. For now, pick one device and keys never leave it - Secret conversations don't currently support popular features like searching message history, switching devices, voice/video, etc - Hundreds of millions use Messenger from a web browser. No secure way to verify co…
Given that I don't have a smartphone, and use messenger.com; yeah, I wouldn't want it to require a mobile.
Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol
#59From what is written, I understand this to mean that users can select this feature for specific conversations. That not all messages are subject to this encryption. I am not usually one for paranoia, but is anyone else becoming more suspicious about Facebooks motivations and involvement with gov? This feature is a massive boost for intelligence services dealing with unsophisticated actors. This reduces the haystack s…
Hi. To move all messages to be E2E encrypted, we need credible solution for web clients and every other platform, including old feature phones. This is easier said than done, but is something we are thinking about. Secret Conversations is a step in the right direction.
I think people underestimate just how ludicrously hard it is to provide an encrypted experience that's as good as plaintext. Even showing a chat on multiple devices becomes a hard problem. I agree with you that it's a step in the right direction, and Viber and Whatsapp have a much easier problem to solve, given that both only support device-to-device messaging. The only app that supports multi-device chats that I know of is Silent Phone, but I admit to not being very up to date with the instant messaging landscape.
Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol
#60Reasons from not enabling it by default by @alexstamos (CSO @ Facebook): - FBM is multi-device, and we'd like to see E2E usability improve to support this. For now, pick one device and keys never leave it - Secret conversations don't currently support popular features like searching message history, switching devices, voice/video, etc - Hundreds of millions use Messenger from a web browser. No secure way to verify co…
Some notes:
- Signal does have some multi-device support (the Android and Desktop clients, iOS not yet). I still sometimes have minor issues but overall it works very well.
- Signal does include end-to-end encrypted voice calls (what used to be called RedPhone) that also work quite well. It's my go-to "call from Wifi abroad" solution to avoid roaming charges, and also works very well with a good 4G/3G signal
- The browser issue seems unsolved as of now, WhatsApp's web thingy (routing through the phone) seems to work quite well but obviously only if the phone is on, and WhatsApp requires a phone while FB messenger doesn't so this isn't an option for them.