Facebook and PGP

#1

Post by alexweber » Wed, Jun 03, 2015, 4:41 AM UTC

Re: Facebook and PGP

#2

Post by michaelt » Wed, Jun 03, 2015, 7:03 AM UTC

Another possibility is one of their programmers thought "It would be good if there was more encrypted e-mail going around in general, I wonder if I can get it into facebook somehow" and coded this feature in their free time. Then convinced his managers to integrate it with that argument plus "and it's already coded we just need to merge it in"

Re: Facebook and PGP

#3

Post by alexbecker » Wed, Jun 03, 2015, 7:17 AM UTC

To me the strangest thing about this announcement is that, while the PGP user base is small, I imagine its intersection with Facebook's is much, much smaller. PGP is used by people who are extremely concerned with privacy, which is practically the antithesis of Facebook.

Re: Facebook and PGP

#4

Post by dimino » Wed, Jun 03, 2015, 7:25 AM UTC

What if Google validated PGP signatures for you from trusted, popular certs?

They'd have Facebook's pubkey on file, and -- transparent to you -- would create something analogous to my browser's lock icon in their email browser. Any time you got an email from Facebook, it'd say "Verified Sender".

Heck, couldn't we tie mail from Facebook back to their domain cert given to them by their CA? If it says @facebook.com, and it's passes verification from the cert on facebook.com, then it's actually from Facebook, right?

Re: Facebook and PGP

#5

Post by rrockstar » Wed, Jun 03, 2015, 7:28 AM UTC

alexbecker wrote: post #3

To me the strangest thing about this announcement is that, while the PGP user base is small, I imagine its intersection with Facebook's is much, much smaller. PGP is used by people who are extremely concerned with privacy, which is practically the antithesis of Facebook.

That is why I suspect this is mainly a PR move by Facebook to show they are concerned about your privacy. Although the suggestion in the article about Facebook going in the PGP mail business is much more excited. Not that i would want to host my email on facebook servers, but if they are able to lay the groundwork for usable encrypted email that would be really great.

Re: Facebook and PGP

#6

Post by bbrazil » Wed, Jun 03, 2015, 7:43 AM UTC

dimino wrote: post #4

What if Google validated PGP signatures for you from trusted, popular certs? They'd have Facebook's pubkey on file, and -- transparent to you -- would create something analogous to my browser's lock icon in their email browser. Any time you got an email from Facebook, it'd say "Verified Sender". Heck, couldn't we tie mail from Facebook back to their domain cert given to them by their CA? If it says @facebook.com, and…

This has been done for some time already via DKIM and DMARC, which anyone can configure.

https://support.google.com/a/answer/174124 https://support.google.com/a/answer/2466580

Re: Facebook and PGP

#7

Post by p4bl0 » Wed, Jun 03, 2015, 7:45 AM UTC

The last paragraph of the linked post describes more or less what keybase [1] is.

[1] https://keybase.io/

Re: Facebook and PGP

#8

Post by excel2flow » Wed, Jun 03, 2015, 7:49 AM UTC

Btw, does PGP support triple wrapping to prevent surreptitious forwarding? (S/MIME does - https://www.ietf.org/rfc/rfc2634.txt)

I really don't understand why it has been chosen over S/MIME. Maybe they gave the money to that german guy who wrote it and now they don't want them to be completely wasted :)

Re: Facebook and PGP

#9

Post by SaturateDK » Wed, Jun 03, 2015, 8:13 AM UTC

p4bl0 wrote: post #7

The last paragraph of the linked post describes more or less what keybase [1] is. [1] https://keybase.io/

A little of topic, but if someone would like a invite to keybase let me know :-)

Re: Facebook and PGP

#10

Post by pjbrunet » Wed, Jun 03, 2015, 8:17 AM UTC

Back in the Myspace era, I was bored and created an easy encoder-decoder for people to play with. It worked with Twitter, Facebook and Myspace (cut-paste your encoded text) because it only used basic characters. As you can't see in this animation, I later added random spaces and punctuation to the encoded text so that theoretically it would be harder for social networks to detect and block. The text was encoded in Javascript as you typed, which I thought was cool :-)

You can see it here as a GIF animation http://pjbrunet.com/friends-secret-messages.gif The decoder was just as easy, another pink box under the encoder. Obviously a pro could crack the code but that wasn't the point.

It was free. I advertised it to hundreds of thousands of people at the top of my blog which was 99% social media users and many of them were interested in privacy related topics as I could see from the Google queries. Looking at the CTR on that banner (asking people to try it) I concluded nobody cared. I was obviously targeting people who weren't tech savvy. I had some friends try it, they said they felt like James Bond ;-) That particular app had no traction, but my "pipe letter generator" did much better.

  ╔╔╗════╔╗═╔╗═════╔╗═══════╔╗══════════════════╔═╗╗
  ║║╚╗╔═╗║║═║║═╔═╗═║╚╗╔═╗╔═╗║╠╗╔═╗╔═╗═╔═╗╔═╗╔╦╦╗║═╣║
  ║║║║║╚╣║╚╗║╚╗║║║═║║║║╬║║═╣║╦╣║╚╣║╔╝═║║║║╚╣║║║║╠═║║
  ║╚╩╝╚═╝╚═╝╚═╝╚═╝═╚╩╝╚╩╝╚═╝╚╩╝╚═╝╚╝══╚╩╝╚═╝╚══╝╚═╝║
  ╚════════════════════════════════════════════════╝