Slashdot Mirror
Facebook Messenger To Get End-To-End Encryption
Reader wiredmikey writes: Facebook announced Friday it would roll out optional "end to end encryption" for its Messenger application, following a trend aimed at stronger security and protection against snooping. The new feature will be known as "secret conversations" which can be read only by the sender and recipient. Facebook shared technical details about its implementation of the security in a technical white paper (PDF). Facebook earlier this year began implementing this end-to-end encryption on its WhatsApp messaging service.ZDNet's Zack Whittaker, however, warns about a catch in Facebook's effort. He writes: But already the company has faced some criticism for not encrypting messages by default, instead making the service opt-in, like Apple's iMessage, or even Facebook's other chat app, WhatsApp, which recently switched on default end-to-end encryption earlier this year. Cryptographer and Johns Hopkins professor Matthew Green, who reviewed an early version of the system, said in a tweet that though you "have to turn on encryption per thread," he added that providing encryption to almost a billion people makes it hard to "put that genie back in the bottle."
Keeps a copy on fb servers. So this change is cosmetic
How does Facebook gain from making it an opt-in feature? What's the business rationale?
FB has upgraded service to use the Little Orphan Annie secret decoder ring.
This would imply that there is information of value being exchanged on Facebook; a proposition I find difficult to believe.
Just cruising through this digital world at 33 1/3 rpm...
...that crappy App that Facebook pulled out of their existing App and which I refuse to install because I shouldn't need a separate app or still another chat client.
In other news, when did people become so lazy that everyone uses chat because clicking on an email app is just too big a hassle?
"Only *we* get to keep all that sweet, sweet, saleable data on you, dammit!"
Quo usque tandem abutere, Nimbus, patientia nostra?
That's right.
evil is done in the shadows and in darkness, but bringing it can't operate in the open when light is shined upon it
I love shit like this. So if I march into a daycare center with a visible machine gun, it's ok because it's not hidden... and all will be well with the world. Good intentions and all. Right?
And if I mow down the kiddies, we just chalk it up to the will of God and say they had it coming.
The good news, after all the carnage, I haven't encrypted anything.... so I'm safe with God. But those fuckers who use HTTPS while reading about the news story online should burn in hell for their sins.
Terrorists are killing in the name of their religion and you are using your religion to argue against them?
https://www.youtube.com/watch?...
If you have end-to-end encryption, and you have a conversation on your desktop computer with someone, then that means you won't be able to read that same conversation back using the Messenger app on your mobile. Unless Facebook create some sort of syncing app to allow your conversation to be copied between your devices, of course.
people are crazy if they really think fb will not be watching encrypted conversations.
Just to point out, Zack Whittacker who wrote the ZDNet article mis-typed, as iMessage and WhatsApp are encrypted by default. His following sentence appears to show he actually meant they were automatically encrypted. The opt-in encryption that Facebook and Google are providing will also be the preferred option of the govts / 3 letter agencies that want to keep everything for future use. Its crazy to have Facebook's app on your smartphone anyways...and tracking bracelet with a microphone and camera.
...said the AC.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Why do we need encryption to keep secrets? The Bible teaches us that evil is done in the shadows and in darkness, but bringing it can't operate in the open when light is shined upon it.
- Pastor Mitch
Ok .. whats your full name, DOB, address, SSN and bank account details?
Shine some light on them and you can be sure nothing bad will happen.
I am Slashdot. Are you Slashdot as well?
I might use your channel, but I'll do my own end-to-end encryption over it, thank you.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
The biggest technical flaw I think I see is that man-in-the-middle attacks can occur unless both sides manually check a 256-bit hex value - probably above the technical capabilities of most users. (This is unlike SSL/TLS/HTTPS where clients usually automatically verify the ID of the server, and servers often automatically verify the ID of the client.) From TFA:
>> For every secret conversation Messenger exposes in its interface both participants' identity keys (i.e. IKpk). Users may optionally verify these keys in order to ensure no man-in-the-middle attack is compromising their secret conversations. Messenger displays the 256-bit IKpk values in hexadecimal format.
Good try FB, but no, thank you. Maybe if you convinced smartphone makers to use bigger batterries, I'd think about, but not the way things work right now.
How many more hundred megabytes will this feature add?
Honestly, I've stopped using messenger cause it's the single most inefficient POS I've seen in ages. People used to complain that Microsoft Office was bloated. How about a simple mobile messenger application that consumes hundreds of megabytes?
I'm still having trouble understanding the level of incompetence required to do that to a simple messaging application.
The most laughable thing of all is that Facebook actually wants people to trust them with financial transactions. Yeah, no.
I fail to see how any 'ecryption' matters when Facebook is spying on everything you do, both on an off Facebook.
Does the encryption now work between the product (==user) and the customer (==advertisement company who buys the user information)? What is the threat scenario in here? Some company gets to steal the user information FB sells?
They don't enable it by default because it absolves them of legal responsibility where the users are not legally allowed to turn it on, and do so anyway.
Do you close the door to the bathroom stall when you take a dump?
Do you have passwords on any of your accounts?
Do you make your SS or CC numbers known to the world?
Privacy is a protection.
My eyes reflect the stars and a smile lights up my face.
I'm going to give the AC in this case the benefit of the doubt, and assume he's posting this ironically or sarcastically and actually doesn't believe that drivel.
Next, there is no 'god', but of course no two people will ever agree on that point, so I'll let it go for now.
Now, if this 'Pastor Mitch' character really believes this crap, how about he posts his credit card numbers, bank account numbers, PIN numbers drivers license and social security numbers, and all his other identity-related information on the Internet for anyone to use. Then how about he installs cameras and microphones in every room of his house, including the bathroom, connected to the Internet 24/7/365, never turned off ever, so we can witness what a clean, pious, sanctified, honest life he's living, with nothing to hide. If he won't do all that then I guess we have to assume he's got some Deep Dark Secrets he needs to hide from us all and is going to Hell when he dies! He must be having sex with his wife in a non-missionary position only for procreation purposes or some horrible Sin like that, LOL! These types would make me laugh if they weren't so completely and utterly idiotic -- and so full of shit and hypocritical.
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
If the user really will have to enable encryption per thread, that will be a very useful flag to anybody who cares that the conversation is worth decrypting.
Facebook announced Friday it would roll out optional "end to end encryption" for its Messenger application, following a trend aimed at stronger security and protection against snooping. The new feature will be known as "secret conversations" which can be read only by the sender and recipient.
That's great except that I don't actually trust Facebook so I'm not sure what this would get me. How can I be sure the message remained secure?
End-to-end means user-to-user. Even Facebook will not be able to read the messages.
In principle yes but do you really trust Facebook? Seems like a HUGE opportunity for man in the middle attacks here. Unless you control the encryption keys you really have no assurance that it will be secure and doing encryption and key exchange properly is actually pretty darn hard to do right.
You don't have to trust them. They publish the protocol, people will audit it.
How do you propose to audit the implementation of the protocol? It's kind of like how it doesn't matter who votes - what matters is who counts the votes. I don't really see any way I could realistically trust Facebook to be a trusted intermediary. It doesn't matter what the protocol is if we can't be certain they are following it.
if "they" own *both* ends? It protects Facebook (and the others) from eavesdroppers?
Frankly, wrt. to FB (and Google, and...) I don't give a rat's ass.
1 - Yeah, common courtesy, nobody wants to see/smell that.
2 - All my accounts require passwords, so there's no choice. 1234 is accepted by a lot of sites, though.
3- Everyone and his brother (well, all levels of govt, anyone I've ever worked for, or anyone in the health care industry at least) knows my SS - 575-48-3141 (or is that even a valid number? No way to tell without looking it up.) SSNs are about as "private" as your name. CC numbers not so much, not for privacy as for the same reason I don't leave large stacks of cash lying around.
I don't use FB or its f-ing Mess enger.
Sorry, I don't believe Facebook will store it encrypted and have no backdoors. And with closed-source apps and mysterious back-end stuff, who will ever know for sure, regardless of what they might claim.
So basically, we're making them even more meta data for to say "they encrypted this specifically, lets focus on storing and breaking into this". If it was default, then it wouldnt matter. Only the foolish would trust this feature, IMO.