4 ms·

>Facebook (and any other messaging app) can read all of your messages in plain text The point of end-to-end encryption is that this is not supposed to be true

edmundsauto 7y ago
Since they control the plaintext -> encrypted transition, theoretically they could copy the plaintext payload in the encryption process. If this were hidden (say via steganographic means), it might not be detectable.
thu2111 7y ago
But it is true because all end-to-end encrypted messaging apps today have both ends being ... an app written by the service provider, which gets the public keys from ... the service provider. Do you know WhatsApp encrypts your messages? Or do you just believe it because Facebook said so? How would you tell if the app was modified to disable it? Do you decompile and audit every binary sent to you by the Play Store? What abut the binaries your peers were sent? And what if their key directory served you a wrong key? E2E encryption isn't useless, but I see a whole lot of technical people confused about why it's useful. Namely, it's a legal/political hack. The law says the government can make you hand over data you have. It doesn't say the government can force you to make arbitrary changes to your life or business to enable them to have whatever data they want. Obviously this would be two very different laws with very different impact: specifically, it would be a law enabling law enforcement to compel arbitrary action. Such laws are extremely rare and usually tightly limited. But if such a law were to be passed, the technical infrastructure becomes useless. FB could just be forced to switch it off.
- ryukafalz 7y ago
  In the case where you’re using a centralized service provider with closed source clients written by the same company... sure. E2E crypto does not absolve you of the responsibility of ensuring you trust the client.
deleted 7y ago
[deleted]

edmundsauto 7y ago

Since they control the plaintext -> encrypted transition, theoretically they could copy the plaintext payload in the encryption process. If this were hidden (say via steganographic means), it might not be detectable.

thu2111 7y ago

But it is true because all end-to-end encrypted messaging apps today have both ends being ... an app written by the service provider, which gets the public keys from ... the service provider. Do you know WhatsApp encrypts your messages? Or do you just believe it because Facebook said so? How would you tell if the app was modified to disable it? Do you decompile and audit every binary sent to you by the Play Store? What abut the binaries your peers were sent? And what if their key directory served you a wrong key? E2E encryption isn't useless, but I see a whole lot of technical people confused about why it's useful. Namely, it's a legal/political hack. The law says the government can make you hand over data you have. It doesn't say the government can force you to make arbitrary changes to your life or business to enable them to have whatever data they want. Obviously this would be two very different laws with very different impact: specifically, it would be a law enabling law enforcement to compel arbitrary action. Such laws are extremely rare and usually tightly limited. But if such a law were to be passed, the technical infrastructure becomes useless. FB could just be forced to switch it off.

ryukafalz 7y ago
In the case where you’re using a centralized service provider with closed source clients written by the same company... sure. E2E crypto does not absolve you of the responsibility of ensuring you trust the client.

deleted 7y ago

[deleted]