Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Meta Shuts Down End-to-End Encryption for Instagram Messaging

pcmag.com

Post reply on HN
Print view View original

221–230 of 235 posts

Re: Meta Shuts Down End-to-End Encryption for Instagram Messaging

#221

Post by traderj0e »

CodeCompost wrote: post #198
Valodim wrote: post #174

Earlier quoted context omitted.

I honestly can't tell if this is sarcasm

Okay fair enough, Signal's end-to-end encryption is a lot more complex than that but really how is it a terrible end user experience?

Signal isn't nice to use on multiple devices. I'd lose my chats if I lost my phone without backing up the keys. Actually WhatsApp somehow deleted my chats even though I restored my phone from backup, idk. Signal also stops notifying you if it goes out of date.

It's fine for the use case they're meant for. Unlike Instagram, they had these usability limitations from the start, and they delegated auth completely to the phone providers.

Re: Meta Shuts Down End-to-End Encryption for Instagram Messaging

#223

Post by jesterson »

dyauspitr wrote: post #210
jesterson wrote: post #112

Earlier quoted context omitted.

Would you care to explain why do you think privacy with Apple is any better than other teams?

Because they do privacy well. Everything is encrypted.

Are you forgetting the /s or sarcasm is implied?

Re: Meta Shuts Down End-to-End Encryption for Instagram Messaging

#224

Post by charcircuit »

lrvick wrote: post #193
charcircuit wrote: post #179

Earlier quoted context omitted.

So what? The centralized owner owns the code repo too, so such a restriction doesn't stop anything. Even if Instagram was open source, Meta could remove the E2E chat feature.

If it was open source people could fork.

But a fork wouldn't be installed on billions of people's devices.

Re: Meta Shuts Down End-to-End Encryption for Instagram Messaging

#225

Post by charcircuit »

aeonik wrote: post #207
charcircuit wrote: post #180

Earlier quoted context omitted.

One incentive is that it makes for a simpler user experience.

It's an even simpler user experience to just publicly publish all private information. Can you imaging, I wouldn't even need to give my social security number to another org manually again. Anyone could just look it up. It would make things so easy for everyone.

It's a trade off. If someone wanted they could keep reducing security to improve the user experience, but a product having bad security will be problematic.

>Anyone could just look it up.

Most people's SSNs have already been leaked or stolen so it's just security theater to pretend they are still private information.

Re: Meta Shuts Down End-to-End Encryption for Instagram Messaging

#226

Post by charcircuit »

Craighead wrote: post #187
charcircuit wrote: post #180

Earlier quoted context omitted.

One incentive is that it makes for a simpler user experience.

It's absurd that you're actually taking the position you are

The existence of security vs convenience trade offs is not absurd. Security isn't free to add to a product.

Re: Meta Shuts Down End-to-End Encryption for Instagram Messaging

#227

Post by charcircuit »

stavros wrote: post #201
charcircuit wrote: post #167

Earlier quoted context omitted.

Centralized FOSS software can do the same thing and remove encryption. Open source is not a requirement for security.

Those two claims are independent. Centralized FOSS software cannot do this, since you can audit the source, compile it, and use it that way. Open source is not a requirement for security, sure, but it's much easier to secure OSS.

Having your own version of a chat program that supports E2EE doesn't mean much if everyone else's version of the app can handle it.

Re: Meta Shuts Down End-to-End Encryption for Instagram Messaging

#228

Post by daft_pink »

Barrin92 wrote: post #11
daft_pink wrote: post #7

I'm not sure the value of end to end encryption for proprietary application chats. For emails and SMS messages, your messages are being sent between different multiple servers on the open internet and it opens you up to spying, but end to end encryption on instagram is only protecting your chats from Meta. I find the end to end encryption on Facebook to be detrimental to ease of use, because you always have to use a…

the entire point of encryption is that you don't trust the channel you communicate through, that's what it was invented for, communication across adversarial channels. Distrust is the only condition under which you need encryption. In addition from a practical POV it's if anything the reverse is the case. Email encryption is larp security because plain text is the default, leaks metadata and its interfaces make it tr…

I just think that it makes a lot more sense for interoperable technologies like sms and email, where messages are transmitted between providers and isn’t as crucial for single provider technologies where you should trust the provider. It’s instagram for gods sake. It’s just a bunch of people shooting their shot. DMs aren’t even the point of the service.

Re: Meta Shuts Down End-to-End Encryption for Instagram Messaging

#229

Post by Terr_ »

mrexcess wrote: post #209
Terr_ wrote: post #205

Earlier quoted context omitted.

Ah, but not nearly as dubious as technical solutions to legal problems...

lol honestly, I think a little on the contrary. If we can make a thing impossible technically, the law defers to that. One thing the government really can’t do easily in Western countries is forcing a company to add features or change core functionality.

I'd say those are legal barriers, rather than technical barriers.

For example, suppose the government demands constant access to your core database. You don't need to invent any new algorithms for that, you might just make an SQL user and a firewall exception and call it a day.

Similarly, If you have a messaging client, you don't need complex R&D to steal the "end-to-end" keys.

Re: Meta Shuts Down End-to-End Encryption for Instagram Messaging

#230

Post by dingaling »

jgtor wrote: post #169
charcircuit wrote: post #167

Earlier quoted context omitted.

Centralized FOSS software can do the same thing and remove encryption. Open source is not a requirement for security.

With reproducible builds like Signal does you can be sure the app you've downloaded matches the source code that's been audited: https://github.com/signalapp/Signal-Android/blob/main/reprod...

Do you check?
Post reply on HN