Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook Messenger begins testing end-to-end encryption using Signal Protocol

whispersystems.org

Post reply on HN
Print view View original

241–250 of 312 posts

Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol

#241

Post by dmix »

CaptSpify wrote: post #237
bertil wrote: post #133

Earlier quoted context omitted.

> I am not usually one for paranoia, but is anyone else becoming more suspicious about Facebooks motivations and involvement with gov? I worked for Facebook; I am friends with the people who developed this: I would like to reassure you strongly (well, as much as an Internet stranger can) on their motives. They are the good guys, and this was develop with people being spied on by abusive governments in mind — because…

This might sound offensive, but please don't take it that way, I just don't know how else to phrase it: I have no reason to trust you, or them. Just because you think people have good motives, doesn't mean it's true. I'm sure there are great people working there, but I'm also sure there are shady people working there. Just like at any big org. "Even though you don't know me, trust me, these guys are cool" arguments d…

It's also impossible for us to trust them given NSL's means they can't honest tell us the trusth if "we just go talk to them".

Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol

#242

Post by AckSyn »

eropple wrote: post #224
lorenzhs wrote: post #192

Earlier quoted context omitted.

You can totally run your own server for yourself and your friends: https://github.com/WhisperSystems/TextSecure-Server (you'll have to change the server's URL in the client's source as well and compile it yourself, but that's really easy) What you won't be able to do is federate with the official servers. Oh, and there's also a WebSocket transport (used by the Desktop client) that doesn't involve Google. That just do…

> you'll have to change the server's URL in the client's source as well and compile it yourself, but that's really easy I'm sorry, but is this a joke? "To not use a centralized server that you can neither audit nor trust, you have to recompile the client, but that's easy ?" This smacks of "oh, PGP for email is fiiiiiine." To say nothing of the silliness of the inability to federate.

No, it's not a joke and you shouldn't treat it as such. Non-technical people really shouldn't be whining that their "free service" doesn't cater to a click-and-run crowd. The source is available to the public to create their own, and changing a URL in the code is a single regex command away.

Don't casually disregard him because you or others can't understand basics of doing what it takes to alter and run a service in your own private space.

Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol

#243

Post by ulber »

exolymph wrote: post #217
Spooky23 wrote: post #130

Earlier quoted context omitted.

> "We don't want to disrupt people's current experience." Hahaha. Sounded plausible until I saw that line. When did FB suddenly start caring about that?

Doesn't ring true after how they ripped all messaging functions out of the main Facebook app and forced me to download Messenger.

The fact that "We don't want to disrupt people's current experience." did not previously outweigh other considerations does not mean it is not a consideration. It does imply an upper bound on the weight though.

Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol

#244

Post by dandelion_lover »

ipozgaj wrote: post #176
djsumdog wrote: post #174

Earlier quoted context omitted.

It's like the entire world forgot about PRISM.

Because the whole story was bs? Zuckerberg himself commented on that https://www.facebook.com/zuck/posts/10100828955847631

Do you honestly believe in his words?

Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol

#245

Post by eropple »

AckSyn wrote: post #242
eropple wrote: post #224

Earlier quoted context omitted.

> you'll have to change the server's URL in the client's source as well and compile it yourself, but that's really easy I'm sorry, but is this a joke? "To not use a centralized server that you can neither audit nor trust, you have to recompile the client, but that's easy ?" This smacks of "oh, PGP for email is fiiiiiine." To say nothing of the silliness of the inability to federate.

No, it's not a joke and you shouldn't treat it as such. Non-technical people really shouldn't be whining that their "free service" doesn't cater to a click-and-run crowd. The source is available to the public to create their own, and changing a URL in the code is a single regex command away. Don't casually disregard him because you or others can't understand basics of doing what it takes to alter and run a service in…

I don't casually disregard him. I thoughtfully and with consideration disregard him, and you as well. The idea that there is a priestly-class of technical people and "non-technical people shouldn't whine" is silly. This is not for technical people. This is for non-technical people. I've been doing this stuff for twenty years. But me being able to do it doesn't do a damned thing to help the people who actually need help.

I don't need Signal to communicate with knowledgeable people. We need something to communicate with everyone else.

Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol

#246

Post by felixhandte »

dmix wrote: post #241
CaptSpify wrote: post #237

Earlier quoted context omitted.

This might sound offensive, but please don't take it that way, I just don't know how else to phrase it: I have no reason to trust you, or them. Just because you think people have good motives, doesn't mean it's true. I'm sure there are great people working there, but I'm also sure there are shady people working there. Just like at any big org. "Even though you don't know me, trust me, these guys are cool" arguments d…

It's also impossible for us to trust them given NSL's means they can't honest tell us the trusth if "we just go talk to them".

Many of the engineers who worked on this feature live outside the US.

Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol

#247

Post by Ar-Curunir »

wmccullough wrote: post #225
niftich wrote: post #223

Earlier quoted context omitted.

> I'm assuming for people who don't have strong security backgrounds That's already a bad start. You mean inventing Signal from scratch (which is rough) or incorporating the libsignal protocol into a new messaging app? All of the libsignal repos have a good readme that explains init [1][2] , so you can start there. Browsing Signal source is helpful not so much to understand the protocol, but to see if any special pre…

It may be a bad start, but if we want to see this implemented in many products at a large scale, you'll have to expect that not everyone is a security expert. I swear HN has become riddled with people who want to be contrarian for the sake of being so.

You shouldn't have many different people implementing critical crypto code; that'll lead to horrible broken implementations and compromise of security.

Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol

#248

Post by Ar-Curunir »

softawre wrote: post #110
maxerickson wrote: post #94

Earlier quoted context omitted.

Am I confused? Isn't it impossible to brute force a single properly encrypted message? (where properly means that the protocol and implementation are sound and so on)

This makes a lot of assumptions, like the NSA hasn't broken algorithms we consider secure, that they're not somehow sharing keys, or using a gimped algorithm on purpose, etc.

NSA mostly likely hasn't broken AES or ECC. And the rest of the arguments don't apply in this case; the parent was talking about hope having a few users use encryption makes it easier for Facebook to compromise security. Using gimped algorithms or sharing keys would affect both scenarios equally.

Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol

#249

Post by nxzero »

yoz-y wrote: post #179
nxzero wrote: post #24

Earlier quoted context omitted.

>> "Chat Bots and services and these do not work with E2E encryption" It might be true that FB adding E2E breaks existing bots, but it's false that it breaks that ability to use bots on FB.

It could work but as I said it would be dishonest. If a bot can read your messages then you have to trust a third party to not leak/store them. I believe that he goal of E2E encryption is to remove the need to trust somebody. (Of course you still have to trust FB that they do not backdoor or hinder the encryption but you do not have to trust the third parties)

With a chatbot you are chatting with the bot.

All the bot needs to is be able to use the Signal E2E protocol to establish key & message exchanges.

Nothing dishonest about this and nothing different than existing bots other than one uses E2E and one does not.

Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol

#250

Post by jalami »

If the messenger is not open sourced, it's trivial for Facebook to add something to the client binary (now, with a flag or at some later date) before the Signal libraries are hit. I'm not saying they are doing so, but without a clear way to verify continually, this is just short of security theater. Then there's Facebook facilitating the key exchange which of course is another blind trust as well as all the juicy meta data. Maybe this will quiet some of the nerves of privacy conscious individuals already on the network, but it seems to me more like a marketing label.

I still find it hard to believe so many people trust what they believe to be private communication with close-lipped advertisement companies.

Post reply on HN