Show HN: ZuccNet – Encrypted Facebook Messaging
1–10 of 43 posts
Re: Show HN: ZuccNet – Encrypted Facebook Messaging
#2Interesting idea. The problem that I see is once me and my friend(s) decide together to use some special tool we could just as well decide to use another platform. Might be easier to use as well (even my father knows how to use, for example, Signal). Surely Zuck will not be reading other platform messages if preventing that is your goal ;-)
Re: Show HN: ZuccNet – Encrypted Facebook Messaging
#3I bet Facebook gets a lot more value out of tracking you across services and locations than from the actual contents of your messages.
This doesn't address it; if you're willing to go to these lengths, just switch to another platform that encrypts E2E.
Re: Show HN: ZuccNet – Encrypted Facebook Messaging
#4great as an academic exercise, but not useful in reality.
Re: Show HN: ZuccNet – Encrypted Facebook Messaging
#5Facebook Messenger already has Secret Conversations, which is end-to-end encrypted mode based on the Signal protocol.
Here's the technical whitepaper: https://about.fb.com/wp-content/uploads/2016/07/messenger-se...
Here's some of the academic work on messaging franking that it has driven: https://eprint.iacr.org/2017/664.pdf
Here's the instructions how to use it: https://www.facebook.com/help/messenger-app/1084673321594605
Of course, you need to trust that the client from the app store and no, the implementation is not open source.
Re: Show HN: ZuccNet – Encrypted Facebook Messaging
#6Facebook Messenger already has Secret Conversations, which is end-to-end encrypted mode based on the Signal protocol. Here's the technical whitepaper: https://about.fb.com/wp-content/uploads/2016/07/messenger-se... Here's some of the academic work on messaging franking that it has driven: https://eprint.iacr.org/2017/664.pdf Here's the instructions how to use it: https://www.facebook.com/help/messenger-app/1084673321…
Also, ZuccNet is using RSA-2048-OAEP to encrypt each message: https://github.com/tomquirk/zuccnet/blob/master/src/util/cry...
This is not forward secure. It will also only work for messages under 256 bytes. I don't know what happens in this code if you exceed that message length.
You want to use ephemeral session keys here. Read the Secret Conversations whitepaper as an example.
Re: Show HN: ZuccNet – Encrypted Facebook Messaging
#7Can't seem to login if I'm using 2FA, even with an 'app password'.
Re: Show HN: ZuccNet – Encrypted Facebook Messaging
#8Reminds that Facebook messenger started out as (non federated) XMPP and worked with OTR until they re-factored everything.
For a little while it was possible to just use pidgin, and have OTR work with Google talk (also boycotting fédération), Facebook and general XMPP.
But now the silo walls have been reinforced.
Re: Show HN: ZuccNet – Encrypted Facebook Messaging
#9Facebook Messenger already has Secret Conversations, which is end-to-end encrypted mode based on the Signal protocol. Here's the technical whitepaper: https://about.fb.com/wp-content/uploads/2016/07/messenger-se... Here's some of the academic work on messaging franking that it has driven: https://eprint.iacr.org/2017/664.pdf Here's the instructions how to use it: https://www.facebook.com/help/messenger-app/1084673321…
If you are trusting facebook in any matter, you are misunderstanding something. Whatever they say, they have the keys to decrypt it. It is like trusting the thief to guard your house.
I dislike this "ZuccNet" as the real goal should be abandoning facebook ecosystem but I still think that anything for naive people is better than nothing, so thumbs up.
Re: Show HN: ZuccNet – Encrypted Facebook Messaging
#10Facebook Messenger already has Secret Conversations, which is end-to-end encrypted mode based on the Signal protocol. Here's the technical whitepaper: https://about.fb.com/wp-content/uploads/2016/07/messenger-se... Here's some of the academic work on messaging franking that it has driven: https://eprint.iacr.org/2017/664.pdf Here's the instructions how to use it: https://www.facebook.com/help/messenger-app/1084673321…
If you are trusting facebook in any matter, you are misunderstanding something. Whatever they say, they have the keys to decrypt it. It is like trusting the thief to guard your house. I dislike this "ZuccNet" as the real goal should be abandoning facebook ecosystem but I still think that anything for naive people is better than nothing, so thumbs up.
Your assertion is false. Please read the whitepaper.
Facebook does not have the key to decrypt messages sent with Secret Conversations. It is generated on-device. You can confirm that using simple reverse engineering tools on, say, the Android APK.
Yes, Facebook could subvert the binary by pushing an update. That is the risk you are accepting.