151–160 of 312 posts
Can an exact match for a FB-provided binary be recreated from the open source code? If it's a No, then it's back to trusting FB to do the right thing and it doesn't make a slightest difference what exact protocol it's running or if the source was peer-reviewed behind closed doors.
Earlier quoted context omitted.
It is opt in because there is a huge base of users who use Messenger via the web, and trying to do E2E in that environment is a fool's errand. If you had ever tried to deliver a crypto improvement to an actual shipping product I am sure you would know what sort of limitations one needs to operate within, but please feel free to continue risking other people's lives for the sake of feeling smug in your ignorant dismis…
Let me be clear, I believe this is a step in the right direction. However, I remain generally skeptical of Facebook because I do not agree with a lot of their practices. I did not mean to be smug, I'm sorry if I came off that way. I understand what you are saying about E2E in the browser and I admit that your point is valid. I did not realize there was even a version of Messenger for the browser (I've only used the a…
As far as risking the lives of other people, I think that in our world we tend to assume that being able to eastablish secure channels is not incredibly difficult. We know where to go and what tools to use. 99.99% of the planet lacks this knowledge, and if secure communication is not built in to the tools they use then they will not even know what they are missing.
Facebook (and Messenger) is used in places where the wrong word can get you "dissappeared", and is used to organize events and movements that can have global consequences. Having a tool that enables you to easily establish a secure channel to someone else and know that if you destroy your device then no one, not even Facebook itself, can get the contents of your messages is a powerful thing. Even rubber-hose cryptography can't compromise you or the person you are communicating with.
A useful and easy to use tool like Messenger with this new capability can have profound effects, and knowing that they are using something like the OWS libs to make it all work rather than rolling their own or just giving up and saying that security and mass-market tools cannot co-exist is something I think should be encouraged rather than dismissed.
I'm still sticking with the website version, thanks https://play.google.com/store/apps/details?id=com.facebook.o... Messenger, Facebook This app has access to: Identity find accounts on the device read your own contact card add or remove accounts Contacts find accounts on the device read your contacts modify your contacts Location precise location (GPS and network-based) approximate location (network-based) SMS edit…
Why are you using Facebook in the first place? I thought the HN valued their privacy. Try https://hubzilla.site instead.
From what is written, I understand this to mean that users can select this feature for specific conversations. That not all messages are subject to this encryption. I am not usually one for paranoia, but is anyone else becoming more suspicious about Facebooks motivations and involvement with gov? This feature is a massive boost for intelligence services dealing with unsophisticated actors. This reduces the haystack s…
Reasons from @alexstamos (CSO @ Facebook): - FBM is multi-device, and we'd like to see E2E usability improve to support this. For now, pick one device and keys never leave it - Secret conversations don't currently support popular features like searching message history, switching devices, voice/video, etc - Hundreds of millions use Messenger from a web browser. No secure way to verify code or store keys without routi…
The way it's implemented now still makes it a pain/inconvenient thing to do when you want private conversations. So let's face it. Facebook just wants to get away with the minimum necessary to convey that it cares about privacy, while knowing that only 0.1% of the conversations will ever be encrypted this way.
I've read the whole thread and I'm surprised that nobody mentionned how easy it would be for Facebook to store the secret keys. Page 10 of the white paper mentions that there is a remote key stored on Facebook servers which can be used to decrypt the local key. If Facebook still is to be trusted, I don't see what's the deal here. I think that as soon as you put the words "end-to-end" encryption on a marketing materia…
Earlier quoted context omitted.
It is opt in because there is a huge base of users who use Messenger via the web, and trying to do E2E in that environment is a fool's errand. If you had ever tried to deliver a crypto improvement to an actual shipping product I am sure you would know what sort of limitations one needs to operate within, but please feel free to continue risking other people's lives for the sake of feeling smug in your ignorant dismis…
>but please feel free to continue risking other people's lives for the sake of feeling smug in your ignorant dismissal of this effort OK, I'll bite. How does this commenter's opinion (which is, to be clear, that the feature does not make him/her happy) risk the actual lives of other conscious, living humans?
Earlier quoted context omitted.
> Why doesn't FB just apply encryption on all messages? The same reason Gmail can't work with end-to-end encryption--they want to advertise at you based on message content. I highly doubt there is any government intervention in FB's business strategy, but there seems to be plenty of cooperation after the business decisions are made. (The same is largely true with Microsoft, Google, and yes, even Apple.) It's not real…
> The same reason Gmail can't work with end-to-end encryption--they want to advertise at you based on message content. I wonder how they'd do if they were more open about it. "You're getting Gmail for free because we read your email and advertise to you. However, if you want to pay for a premium account (or Google Apps for Work) then we won't advertise to you, won't read your email and we'll even make end-to-end encr…
This is exactly why these companies don't want to be more transparent unless they absolutely have to (like what the EU is doing to Google), but it really should be more regulated by governments, because I think it's a very "fair" thing to do - sharing everything you're doing with someone's info. It's not about restricting the data collection through regulation, just being transparent about it. That might lead to less useful information for the data collectors, but people should be informed and it should trump everything else.
Now that the Signal Protocol is deployed in so many different places, is there a proper specification of the (current) protocol? (The old axolotl spec and the GPL implementation don't qualify) What are the licensing conditions / restrictions for using the protocol?
Earlier quoted context omitted.
Server would have the keys _because_ the client-side code can send it to the server. That's also possible in the native app, isn't it?
Yes. But let's assume FB doesn't want the keys (because if they have them, then it's no longer E2E encryption), then client-side generated keys in a browser are still exposed to XSS attacks and extensions. Installing a malicious extension, tricking users into typing commands in the developer tools, XSSing FB, all of these are much easier to do than attacking a native app on a phone.