Facebook Messenger To Get End-To-End Encryption

Reader wiredmikey writes: Facebook announced Friday it would roll out optional "end to end encryption" for its Messenger application, following a trend aimed at stronger security and protection against snooping. The new feature will be known as "secret conversations" which can be read only by the sender and recipient. Facebook shared technical details about its implementation of the security in a technical white paper (PDF). Facebook earlier this year began implementing this end-to-end encryption on its WhatsApp messaging service.ZDNet's Zack Whittaker, however, warns about a catch in Facebook's effort. He writes: But already the company has faced some criticism for not encrypting messages by default, instead making the service opt-in, like Apple's iMessage, or even Facebook's other chat app, WhatsApp, which recently switched on default end-to-end encryption earlier this year. Cryptographer and Johns Hopkins professor Matthew Green, who reviewed an early version of the system, said in a tweet that though you "have to turn on encryption per thread," he added that providing encryption to almost a billion people makes it hard to "put that genie back in the bottle."

Comments

To my knowledge messenger unlike whatsapp

[MarkH]

Keeps a copy on fb servers. So this change is cosmetic

This would imply

[JustAnotherOldGuy]

This would imply that there is information of value being exchanged on Facebook; a proposition I find difficult to believe.

Re:This would imply

[Opportunist]

If only important messages were encrypted, every bad person would instantly know which ones he should decrypt.

Re:This would imply

[gsslay]

You are absolutely right. What you put on Facebook is of no value whatsoever. You have nothing to regret giving it to us. We just like collecting meaningless chatter and none of our client advertisers have the slightest interest in it. Nothing to worry your little heads over, nothing to see here.

- Mark Zuckerberg

Re:Translation:

[cryptizard]

End-to-end specifically means that Facebook can't read it, if it is implemented as they say. The ends in question are both users.

Re:Why use we keep secrets?

[The-Ixian]

Do you close the door to the bathroom stall when you take a dump?

Do you have passwords on any of your accounts?

Do you make your SS or CC numbers known to the world?

Privacy is a protection.

Re:Breaks reading messages on phone and desktop

[cryptizard]

That's true, but you do need some "anchor" device for this to work or else there is nothing to bind together the many browser you may have across many devices. Without of course just giving Facebook the key like you said. In practice, most people have the phone's on and connected to cellular internet most of the time. I have used WhatsApp a lot and it really isn't an issue.

Re:Translation:

[Fnord666]

No they haven't, read the description of their implementation.

No thanks, I would rather read their actual implementation (ie open source). The only way you can even begin to trust such a communications system is if it is open source and you can build the client from the provided source. Insert oblig reference to Ken Thompson's "Reflections on Trusting Trust" here. At any rate, the description of the implementation is not the implementation itself.