9 ms·

Some folks in this thread are convinced that end-to-end encryption is going away when the article says the exact opposite.

handzbagz 8y ago
Unless they radically change how Facebook messenger works I don't see how it could even be called end-to-end encryption. For it to work how it does now (online and independently through the app) they would have to hold the encryption keys. They would have to instead tie Facebook messenger to a phone like Whatsapp does and use a web app to send messages directly from the device instead. I don't see how else it could be done and still be called end-to-end encryption.
- nindalf 8y ago
  > Unless they radically change And according to the article, this radical change is coming. Why is that so hard to believe?
  - throwawaylolx 8y ago
    Because there are no details beyond vague promises, and it entails serious restructuring and UX trade-offs that may affect revenue. At the moment, skepticism makes much more sense.
    - nindalf 8y ago
      Just to be clear, do you think that the NYT is mistaken, or that Facebook has committed to something that is too difficult to execute due to technical and revenue concerns?
      - throwawaylolx 8y ago
        I don't think they committed to anything. It's just vague promises that can be reinterpreted in many ways, most of which can compromise trustworthy e2e encryption while also implementing some form of loophole-ridden e2e encryption. Yeah, WhatsApp is e2e encrypted by default, but it also automatically backs up all your chat history encrypted using a WhatsApp-owned private key. Sure, you can opt-out of backups, but will your peers do as well? Without a clear spec, I think it's perfectly reasonable to be very skeptical of what will be the final product of this operation.
        nindalf 8y ago
        > just vague promises Now I know you didn't read the article. There were no promises made because this was based on conversations with employees, not a press release.
losvedir 8y ago
I came to the comments to see how this can even be done. It seems like a classic case of a CEO promising something that engineering can't deliver, but Zuck is quite technical himself so I'd be surprised by that. AFAIK, end to end encryption can't really support having multiple clients all using the same account. For example, WhatsApp's web interface is sort of wonky and goes via the phone, to get around the limitations, and I can't really see that being a solution here. Of course, "end to end" encryption from a Messenger on the website is sort of meaningless anyway.
- wtmt 8y ago
  > AFAIK, end to end encryption can't really support having multiple clients all using the same account. Improving your AFAIK here. Signal Desktop works independently without proxying communications through the phone (which is what WhatsApp does). Wire supports multiple platforms (Windows, Mac, mobile) and syncs chats across all of them with end to end encryption. There are different ways to do this. It's just that WhatsApp didn't implement it.
  - losvedir 8y ago
    Oh interesting, thanks! Do you have any references on how Signal Desktop works and keeps the messages in sync across clients? Do they have separate keys, etc?
oska 8y ago
Zuckerberg and Facebook deserve the highest degree of scepticism.

handzbagz 8y ago

Unless they radically change how Facebook messenger works I don't see how it could even be called end-to-end encryption. For it to work how it does now (online and independently through the app) they would have to hold the encryption keys. They would have to instead tie Facebook messenger to a phone like Whatsapp does and use a web app to send messages directly from the device instead. I don't see how else it could be done and still be called end-to-end encryption.

nindalf 8y ago
> Unless they radically change And according to the article, this radical change is coming. Why is that so hard to believe?
- throwawaylolx 8y ago
  Because there are no details beyond vague promises, and it entails serious restructuring and UX trade-offs that may affect revenue. At the moment, skepticism makes much more sense.
  - nindalf 8y ago
    Just to be clear, do you think that the NYT is mistaken, or that Facebook has committed to something that is too difficult to execute due to technical and revenue concerns?
    - throwawaylolx 8y ago
      I don't think they committed to anything. It's just vague promises that can be reinterpreted in many ways, most of which can compromise trustworthy e2e encryption while also implementing some form of loophole-ridden e2e encryption. Yeah, WhatsApp is e2e encrypted by default, but it also automatically backs up all your chat history encrypted using a WhatsApp-owned private key. Sure, you can opt-out of backups, but will your peers do as well? Without a clear spec, I think it's perfectly reasonable to be very skeptical of what will be the final product of this operation.
      - nindalf 8y ago
        > just vague promises Now I know you didn't read the article. There were no promises made because this was based on conversations with employees, not a press release.

losvedir 8y ago

I came to the comments to see how this can even be done. It seems like a classic case of a CEO promising something that engineering can't deliver, but Zuck is quite technical himself so I'd be surprised by that. AFAIK, end to end encryption can't really support having multiple clients all using the same account. For example, WhatsApp's web interface is sort of wonky and goes via the phone, to get around the limitations, and I can't really see that being a solution here. Of course, "end to end" encryption from a Messenger on the website is sort of meaningless anyway.

wtmt 8y ago
> AFAIK, end to end encryption can't really support having multiple clients all using the same account. Improving your AFAIK here. Signal Desktop works independently without proxying communications through the phone (which is what WhatsApp does). Wire supports multiple platforms (Windows, Mac, mobile) and syncs chats across all of them with end to end encryption. There are different ways to do this. It's just that WhatsApp didn't implement it.
- losvedir 8y ago
  Oh interesting, thanks! Do you have any references on how Signal Desktop works and keeps the messages in sync across clients? Do they have separate keys, etc?

oska 8y ago

Zuckerberg and Facebook deserve the highest degree of scepticism.