Live data from Hacker News

Facebook Messenger begins testing end-to-end encryption using Signal Protocol

whispersystems.org

61–70 of 312 posts

Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol

#61
It's worth remembering that this does not protect metadata. It's believed (though not known for sure) that WhatsApp logs metadata for their encrypted messages, and it looks like Facebook do the same here.

If you want to resist mass surveillance this is not a good solution.

Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol

#62

Reasons from not enabling it by default by @alexstamos (CSO @ Facebook): - FBM is multi-device, and we'd like to see E2E usability improve to support this. For now, pick one device and keys never leave it - Secret conversations don't currently support popular features like searching message history, switching devices, voice/video, etc - Hundreds of millions use Messenger from a web browser. No secure way to verify co…

Signal Protocol already supports multi-device. We've encouraged them to enable that for Secret Conversations, and hopefully they'll continue to iterate towards support for e2e by default.

Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol

#63
post #6

"End-To-End Encrypted ‘Secret Conversations’" in software that is ordinarily used to harvest electronic phone books and rummage through user photos, from a company that made its whole fortune trying to obliterate privacy as a part of human culture? It's going to be pretty high standards of proof to give this anything that resembles credibility.

Credibility isn't binary. Facebook was way down to 0% on the credibility scale, and now it's up to 5%. Let's applaud this move instead of being hostile when they're trying to improve, because the only thing that will achieve is to discourage improvement.

Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol

#64

Moxie and team, bravo. You've made the snoopers jobs a whole lot harder. Your goal of making encryption easy to use by the masses is coming come true. It looks as if PGP's days are numbered.

> It looks as if PGP's days are numbered.

This seems gratuitously hostile (and, even worse, is irrelevant). PGP is a very useful piece of software, and it does something completely different from Signal, and I'm glad both exist.

Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol

#65
Genuinely thrilled to see the Signal protocol adopted for Facebook and Google stuff (albeit optionally). Now if we can just get Microsoft and Amazon to hop on-board, we might actually have a shot at getting this standard to be pervasive.

Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol

#66
post #7

I'm still sticking with the website version, thanks https://play.google.com/store/apps/details?id=com.facebook.o... Messenger, Facebook This app has access to: Identity find accounts on the device read your own contact card add or remove accounts Contacts find accounts on the device read your contacts modify your contacts Location precise location (GPS and network-based) approximate location (network-based) SMS edit…

I use Swipe for Facebook ever since they got rid of messages. It needs no permission, and while the experience can't be as good as Messenger, it will at least let me reply to the occasional message I receive.

I don't want to be encouraging Facebook's user-hostile moves, so I'll stop using messages completely if they make my life hard enough, but Swipe is a nice stopgap.

Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol

#67

How can I verify my device is indeed running the signal protocol? Messenger is a proprietary app.

If you need to ask this question then you don't have the skills to verify that your device is running a secure protocol even if I handed you the source code. There are people out there who do have the skills, and you can be certain that they will be reverse-engineering the distributed binaries as soon as possible. I would be extremely surprised if there was not a lightning talks or two at DefCon or BH this year going over the actual on-device code and how closely it hews to the known protocol.

Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol

#68
what's the difference between

- Messenger

- plain vanilla messages i get in Facebook web site

- 'chat' messages, were I to turn on 'chat' in Facebook web site

i'm not asking rhetorically. i honestly can't keep up with all the messaging avenues availabale today...

Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol

#69
post #61

It's worth remembering that this does not protect metadata. It's believed (though not known for sure) that WhatsApp logs metadata for their encrypted messages, and it looks like Facebook do the same here. If you want to resist mass surveillance this is not a good solution.

I think we're going to have to get there (wherever there is: Utopia is a different place for different people) incrementally. It may be unsatisfactory in the short/near term and arguably give people a false sense of security but if we can start educating those non-techies around us bit by bit we may stand a chance at driving mass adoption. Honestly, I'm in no way claiming I can see the future or have even some of the answers, this shit is hard - perhaps even impossible.

Re: Facebook Messenger begins testing end-to-end encryption using Signal Protocol

#70

Moxie and team, bravo. You've made the snoopers jobs a whole lot harder. Your goal of making encryption easy to use by the masses is coming come true. It looks as if PGP's days are numbered.

> It looks as if PGP's days are numbered. This seems gratuitously hostile (and, even worse, is irrelevant). PGP is a very useful piece of software, and it does something completely different from Signal, and I'm glad both exist.

>> It looks as if PGP's days are numbered

Comments like this are inevitable and represent Facebook's attempts to induce us to route all of our communications though its platform. For the quoted commenter, it's probably too late.

Post reply on HN