5 ms·
For a company the size of facebook, I am having trouble understanding what is the difficulty in rolling this out. At this rate, the virtual world they are maki
by rasengan 5y ago
For a company the size of facebook, I am having trouble understanding what is the difficulty in rolling this out.
At this rate, the virtual world they are making will take 100 years, or simply, it will be even more difficult to trust facebook.
- mgraczyk 5y agoIt's difficult to roll out because the vast majority of users don't want it. Facebook is trying to find ways to add it without breaking UX and without making it too difficult for people in the EU (where encryption will be required) to talk to people outside the EU (where it may be optional).
- rasengan 5y agoWhy would someone want to opt out of end to end encryption?
- deleted 5y ago[deleted]
- mgraczyk 5y agoI don't want E2EE because I don't care at all whether or not Facebook has the plaintext of my chats, and I don't want to make any of the usability tradeoffs required for E2EE to work.
- bostonsre 5y agoWhat useability tradeoffs? If you don't care if your chats are in plain text, then you shouldn't care if they are encrypted.
- mgraczyk 5y agoIf my chats are encrypted and FB doesn't have the private key, I can't send messages from my desktop without either 1. my phone is on and does a secure key exchange each time I login on desktop, in which case I have to carefully audit complex novel crypto or trust that FB doesn't snoop the key during the exchange. or 2. I have to scan some QR code or some other bullshit to make desktop chat work. And more importantly, it's possible for me to lose my message history if I lose all my devices. I don't want any of these.
- nitrogen 5y agoOr 3, use a time- and memory-hard key derivation algorithm that generates your private key from a password that is never sent to the server.
- mgraczyk 5y agoAnd if a user forgets the password, all their messages are gone! Also, requiring that users memorize another password is a pretty huge UX burden. Remember that FB has billions of users, so we're talking about mostly non saavy users. No popular E2EE messaging service that does this as far as I'm aware.
- bostonsre 5y ago> 1. my phone is on and does a secure key exchange each time I login on desktop, in which case I have to carefully audit complex novel crypto or trust that FB doesn't snoop the key during the exchange. This isn't a usability tradeoff, is it? If you don't care that your messages are in clear text, then I don't see why you would then be forced to audit how their crypto works to be sure that it works so that you could then use that crypto for messaging. I don't audit how my web browser uses ssl, do you? > 2. I have to scan some QR code or some other bullshit to make desktop chat work. > And more importantly, it's possible for me to lose my message history if I lose all my devices. Yea, these do seem like potential usability issues and I could see these being valid reasons for them not wanting to roll it out. That being said, they are facebook and they have a ridiculous amount of engineering talent to apply. I would be really curious to know why they think they can solve the problem well it in a few years but not in a shorter time frame or if they don't think they can achieve it in a few years and are just kicking the can down the road in the hope that everyone forgets about the can later.
- hunter2_ 5y agoI've begun using E2EE on FB Messenger and these are the tradeoffs I've noticed: - Photos don't pinch-to-zoom - No read-receipt indicators - No reactions besides the primary emoji - Primary emoji can't be changed - No nicknames or other frills ...none of which have anything to do with E2EE itself. Feels like MVP issues, to be honest.
- deleted 5y ago[deleted]
- daurnimator 5y ago- server-side searching of messages becomes impossible; this essentially breaks message search for most people - depending on how it's done, it can mean the loss of messages when changing devices (one of the top complaints I hear about signal)
- bostonsre 5y agoWas there some kind of poll that shows that users don't want encryption? What reasons do those users have for not wanting encryption? What was would adding encryption break ux?
- GekkePrutser 5y agoActually the EU is working on mandating backdoored E2E so they don't want this. https://news.ycombinator.com/item?id=29200506 https://news.ycombinator.com/item?id=29200506 https://news.ycombinator.com/item?id=29308617 https://news.ycombinator.com/item?id=29308617
- pavlov 5y agoHere’s a good thread from someone who saw it from the inside: https://twitter.com/elegant_wallaby/status/1462845336288825344?s=21 https://twitter.com/elegant_wallaby/status/14628453362888253... Basically management assumed (as it seems that you do) that E2EE is a technical feature that can be flipped on without changing anything in how the social model works on Meta’s three distinct, unconnected messaging systems.
- rasengan 5y agoThe unencrypted messaging didn't seem to stop Jefferey Epstein and Ghislaine Maxwell, nor the many who participated in the activities with them.
- deleted 5y ago[deleted]
- smolder 5y agoIt is a technical feature. It can be "flipped on", though that exaggerates the ease. That they're delaying e2ee doesn't surprise me, but that they claim to want to implement it in the first place does. I think the intent to implement it is a effectively a farce to convince us that the "hard choice" FB will make to not give users privacy was all about protecting our children. Child sex abuse could be brought to a practical minimum without reading everyone's communication, and reading comms is not going to stamp it out. Reading everyone's communication is the prize, not saving kids.
- DreamWalker1 5y agoThat's the point: Large system = difficult to change Not only because of technical challenges, but also regulatory issues. The Metaverse doesn't really have users, so you could progress faster - but I highly doubt it as well.