[deleted]
Facebook Messenger begins testing end-to-end encryption using Signal Protocol
71–80 of 312 posts
Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol
#72How can I verify my device is indeed running the signal protocol? Messenger is a proprietary app.
If you need to ask this question then you don't have the skills to verify that your device is running a secure protocol even if I handed you the source code. There are people out there who do have the skills, and you can be certain that they will be reverse-engineering the distributed binaries as soon as possible. I would be extremely surprised if there was not a lightning talks or two at DefCon or BH this year going…
We've verified that FBM is using the unmodified open source Signal Protocol libraries we distribute at open whisper systems. Hopefully others will verify the same!
Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol
#73what's the difference between - Messenger - plain vanilla messages i get in Facebook web site - 'chat' messages, were I to turn on 'chat' in Facebook web site i'm not asking rhetorically. i honestly can't keep up with all the messaging avenues availabale today...
I'm pretty sure they're all the same thing.
Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol
#74I'm really skeptical about this. First of all, Facebook collects more user data than just about any company out there. They make most of their money off of advertising and harvesting user data and metadata. Facebook is just about the last company I'd trust to encrypt data of mine. It's like them saying, "hey, I know we make most of our revenue off of collecting user data but I think we should throw away a huge portio…
It is opt in because there is a huge base of users who use Messenger via the web, and trying to do E2E in that environment is a fool's errand. If you had ever tried to deliver a crypto improvement to an actual shipping product I am sure you would know what sort of limitations one needs to operate within, but please feel free to continue risking other people's lives for the sake of feeling smug in your ignorant dismis…
>but please feel free to continue risking other people's lives for the sake of feeling smug in your ignorant dismissal of this effort
OK, I'll bite. How does this commenter's opinion (which is, to be clear, that the feature does not make him/her happy) risk the actual lives of other conscious, living humans?
Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol
#75I'm really skeptical about this. First of all, Facebook collects more user data than just about any company out there. They make most of their money off of advertising and harvesting user data and metadata. Facebook is just about the last company I'd trust to encrypt data of mine. It's like them saying, "hey, I know we make most of our revenue off of collecting user data but I think we should throw away a huge portio…
It is opt in because there is a huge base of users who use Messenger via the web, and trying to do E2E in that environment is a fool's errand. If you had ever tried to deliver a crypto improvement to an actual shipping product I am sure you would know what sort of limitations one needs to operate within, but please feel free to continue risking other people's lives for the sake of feeling smug in your ignorant dismis…
[deleted]
Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol
#76Reasons from not enabling it by default by @alexstamos (CSO @ Facebook): - FBM is multi-device, and we'd like to see E2E usability improve to support this. For now, pick one device and keys never leave it - Secret conversations don't currently support popular features like searching message history, switching devices, voice/video, etc - Hundreds of millions use Messenger from a web browser. No secure way to verify co…
Signal Protocol already supports multi-device. We've encouraged them to enable that for Secret Conversations, and hopefully they'll continue to iterate towards support for e2e by default.
That's nice! :)
What did the OP mean by "No secure way to verify code or store keys (in web browser) without routing through mobile" ?
Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol
#77It's worth remembering that this does not protect metadata. It's believed (though not known for sure) that WhatsApp logs metadata for their encrypted messages, and it looks like Facebook do the same here. If you want to resist mass surveillance this is not a good solution.
https://ricochet.im/ is a good option if you're looking to minimize the amount of metadata that gets leaked. Desktop only at the moment, though, due to the difficulties of running a Tor hidden service from a mobile device.
Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol
#78It's worth remembering that this does not protect metadata. It's believed (though not known for sure) that WhatsApp logs metadata for their encrypted messages, and it looks like Facebook do the same here. If you want to resist mass surveillance this is not a good solution.
I'd argue that WhatsApp and FBM adopting signal have been some of the highest-impact movements toward resistance of mass surveillance, largely due to sheer numbers and accessibility.
Sure, there is room for improvement, but having 0.000001% of t he population using an ultra-secure messenger doesn't have the same impact.
And hopefully those improvements will happen in time.
Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol
#79I'll use if could communicate with non-Facebook programs implementing Signal protocol.
Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol
#80Earlier quoted context omitted.
Could you elaborate on why applying signal protocal in a browser is next to impossible?
Well, the keywords there are next to. Like @remy_ implied, you need a mechanism for guaranteeing that the logic you're executing in-browser is protected from server compromise. That's where the Cyph example came in, since as far as I can tell, Cyph is the team to have hacked together a solution to that dilemma, though Cyph also is not using the Signal Protocol right now. Anyway, there's an upcoming defcon talk which'…
What is the difference between compromising a web server that serves js library vs the one that serves device-native app binary?
This always s gets brought up when discussing in-browser crypto and could never get a satisfactory answer.