Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook Messenger begins testing end-to-end encryption using Signal Protocol

whispersystems.org

Post reply on HN
Print view View original

141–150 of 312 posts

Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol

#141

Post by dragonwriter »

josho wrote: post #135
arximboldi wrote: post #107

Earlier quoted context omitted.

Hundreds of millions use Messenger from a web browser. No secure way to verify code or store keys without routing through mobile. I wouldn't use the web version if they had not disabled Jabber access... and then I could use OTR. This trend makes me very sad... IM networks are getting more centralized as ever. I don't feel thankful for this kind of development. End-to-end encryption should not be a feature of the serv…

> digital prisons Did you just coin that? It appropriately captures what is going on, but without having the positive connotation that comes from a 'walled garden'. I love the phrase. As an example outside of messaging, I have a fitbit and 'digital prison' so aptly describes what happens with my personal health data. I can't get my heart rate data out of their prison, because the fitbit warden doesn't see it fit to g…

"Walled garden" is more appropriate than "digital prison". No one is being sentenced involuntarily to these enclosures, they are voluntarily choosing to accept them because of what is inside them.

Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol

#143

Post by rdslw »

davb wrote: post #17
napoleond wrote: post #9

Earlier quoted context omitted.

> Why doesn't FB just apply encryption on all messages? The same reason Gmail can't work with end-to-end encryption--they want to advertise at you based on message content. I highly doubt there is any government intervention in FB's business strategy, but there seems to be plenty of cooperation after the business decisions are made. (The same is largely true with Microsoft, Google, and yes, even Apple.) It's not real…

> The same reason Gmail can't work with end-to-end encryption--they want to advertise at you based on message content. I wonder how they'd do if they were more open about it. "You're getting Gmail for free because we read your email and advertise to you. However, if you want to pay for a premium account (or Google Apps for Work) then we won't advertise to you, won't read your email and we'll even make end-to-end encr…

It would be a (financially) bad choice for corpo. And answer why, is the same in many similar questions 'why can't corpo do this-and-that'.

Here it is (google as an example only, simplified) the answer:

* Put two googles side by side. competing.

* one is a current one, earning money from ads on you being product, and keeping it under the radar (although in fine print etc etc)

* second is the one devised: premium accounts plus free w/ads

* wait 5 years and observe by market efficiency evolution which of the (competing) companies wins. The first one. In this specific scenario, the second loses because time and money spent on 'premium accounts' will not be compensated by revenues from it. While at the same time, the first google, spending this capital difference purely on the ads department will make its ads department (here 100% of it) much better than ads part in second company. hereby winning on the market.

In general (as the google example is SIMPLIFIED, due to the alphabet scale. Please don't use google apps FOR WORK (emphasis mine ;) as an counter example - it's B2B product :) it is because: we, humans, don't like companies who use fine print etc, yet those companies win case by case with the 'moral, pure pricing and fine ethics' companies BECAUSE OF BIASES AND ERRORS (+) OF HUMAN BRAINS during choice making shopping, exploited day by day.

Thats why.

(+) read stupidity also known why-I-buy-overpriced-sweets-at-checkout ;)

Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol

#144

Post by buu700 »

tptacek wrote: post #138
buu700 wrote: post #137

Earlier quoted context omitted.

I think he was only (or mostly) talking about the latter, which I would agree isn't very complicated at all (it's just deleting and regenerating keys/certs on an interval). As to the former, are you referring to specific known side channel attacks against asm.js/wasm, or just the usual XSS risk?

One would hope that the founder of the company trying to bring that weird secure caching attempt to market would believe that it wasn't very complicated. :) Of course, if you've filed for patents on this, as was suggested upthread, that somewhat cuts against that argument, doesn't it?

lol, I'm definitely biased given that I'm long since familiar with the idea and wrote the implementation, but I think it's more conceptually counterintuitive/clever/weird than it is actually complicated in terms of having many moving parts.

WebSign does have a patent pending on it (I think it's fair enough to say that the whole system of accomplishing in-browser code signing this way was non-obvious), but HPKP Suicide itself doesn't. Bryant (eganist) and I are actually disclosing and open sourcing implementations of a few non-code-signing applications of HPKP Suicide at Black Hat and DEF CON next month.

Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol

#146

Post by Sylos »

emdd wrote: post #15
etiam wrote: post #6

"End-To-End Encrypted ‘Secret Conversations’" in software that is ordinarily used to harvest electronic phone books and rummage through user photos, from a company that made its whole fortune trying to obliterate privacy as a part of human culture? It's going to be pretty high standards of proof to give this anything that resembles credibility.

This is exactly what I'm thinking. I expect a post in he next day or so from Open Whisper people to lend credibility to this project. They seem to be the Go-To these days. Edit: and it is http://www.whispersystems.org/blog/facebook-messenger

Yeah, but then, again, how much credibility does Open Whisper Systems actually deserve?

For me personally, they've lost a huge chunk of credibility by lending credibility to companies for apparently rewriting the definition of "end-to-end-encryption" from previously referring to the users as the end to now referring to some magical proprietary blackbox as the end.

And the other chunk of credibility sort of died off, as they apparently seem to think depending on proprietary Google software for their products is how you do privacy.

That is, their Android-client for Signal depends on Google Play Services for receiving notifications, even though LibreSignal exists, which is a fork specifically to remove that dependency, and from which they could have easily pulled that changed code in as a fallback.

And when they figured they should make a desktop client, apparently the best technology that they could think of, was a Google Chrome extension.

Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol

#147

Post by jmme »

marak830 wrote: post #2

Last I heard, didn't their messenger app pull a ton of not required permissions on Android?

The Messenger app has Android M permissions model now. you can say no to all of the prompts if you want. I have all of Camera, Contacts, Location, Microphone, Phone, SMS, and Storage permissions disabled.

Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol

#148

Post by egeozcan »

captainmuon wrote: post #126
Techbrunch wrote: post #38

Earlier quoted context omitted.

Reasons from @alexstamos (CSO @ Facebook): - FBM is multi-device, and we'd like to see E2E usability improve to support this. For now, pick one device and keys never leave it - Secret conversations don't currently support popular features like searching message history, switching devices, voice/video, etc - Hundreds of millions use Messenger from a web browser. No secure way to verify code or store keys without routi…

> No secure way to verify code or store keys without routing through mobile. Weeeeeeell, not quite. Every device and browser the user uses can get it's own private key, and then you use Facebook's central servers and SSL to exchange keys. If I don't trust Facebook for key exchange, then I can't trust them with their app. Any encryption they implement, they can trivially circumvent by putting a backdoor in their app.…

Yes I completely agree. Actually, what is the difference in security between an app that generates a key pair on first use and exchanges the public key via a 3rd party servers and a web application doing exactly that. As long as the connection is secure and you trust the 3rd party for not having you send the private key to them, the model seems reasonably secure for both scenarios.

Though public key exchange can be improved on mobile by better direct communication capabilities like barcode scanning, rfid, bluetooth etc.

Am I missing something or is this more of a "JS is not reliably fast on all devices so we rather don't" kind of thing?

Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol

#150

Post by theseatoms »

reacweb wrote: post #117
_Understated_ wrote: post #42

Earlier quoted context omitted.

A by product of what? 86% of their profits come from advertising[1]. If that's not the definition of an ad company then I don't know what is. [1] - http://adage.com/article/digital/google-q4-2015-earnings/302...

That is not the point. Money is just a mean. Read http://www.artificialbrains.com/google http://bigdata-madesimple.com/12-famous-quotes-on-artificial... http://mashable.com/2015/05/12/elon-musk-fears-larry-page/#1... http://www.pcmag.com/article2/0,2817,2460571,00.asp .

Money is absolutely not a mean. Google is a public company. Money is its ultimate end.
Post reply on HN