13 ms·

Expanding Features for End-to-End Encryption on Messenger

59 points by thm 4y ago

blamestross 4y ago
So is this liability reduction for them? Too many subpoenas and this makes responding to them more efficient? It doesn't seem like "messenger is e2e encrypted" actually matters for marketing and adoption so either it is a cheap fiction for marketing or there is a motive I don't understand.
- baby 4y ago
  IMO the value comes in this order: 1. liability reduction 2. interop with WhatsApp 3. marketing 4. added security for their users :D
  - 56friends 4y ago
    #2 is interesting. I am very curious what the ultimate plan for having 2 messaging apps is (at least in Zuck’s head). My bet is that his fantasy is to eventually merge them into a single service: Meta Messenger.
    - baby 4y ago
      Yeah I believe the plan for interop has been public for years now
      - i67vw3 4y ago
        FB messenger is largely used in US. In non-US countries everyone uses Whatsapp. If they drop whatsapp to combine both of them, it will have quite serious effects and completely ruin the whole 'thing'.
        baby 4y ago
        interop is not about dropping one over the other, it's about being able to talk to messenger user through whatsapp
        56friends 4y ago
        They could do this very gradually. First rename WhatsApp to Meta Messenger. Keep everything else the same. Then with interop being implemented slowly merge FB messenger into Meta Messenger.
teddyh 4y ago
Does is pass the mud puddle test?
- capableweb 4y ago
  That's a joke anyways. Regardless if Facebook can/will/wont/pretend to not being able to give you your data back, they could store it.
atonse 4y ago
Curious as to why they suddenly seem to care about adding E2E? I wonder if, with ML models running on devices now, they've found a way to show relevant-enough ads by doing all the "relevancy" processing on-device, at one of the "ends" of the encrypted chat. It just doesn't add up.
- tapoxi 4y ago
  Probably because their main competitor, iMessage, is E2E. If they can be E2E and cross-device, they can take share from Apple.
  - baby 4y ago
    BTW, iMessage is not their main competitor (or even comparable to a non-text message cross-platform messaging app). IMO that was messaging from Facebook to avoid antitrust issues. Their main competitors are telegram, wechat, kakao.
    - JumpCrisscross 4y ago
      In the U.S., the competition is Discord; overseas, WeChat, QQ, Snapchat and Telegram [1]. iMessage is a tool for the rich or young [2]. [1] https://spectrm.io/insights/blog/messaging-app-statistics-most-popular-communication-method-2020/ https://spectrm.io/insights/blog/messaging-app-statistics-mo... [2] https://www.androidauthority.com/imessage-big-deal-guide-3087606/ https://www.androidauthority.com/imessage-big-deal-guide-308...
  - masterof0 4y ago
    I agree with baby here, iMessage ate their lunch long ago,their competition is Kakao, Line, and the likes, not even Wechat, as they have 0 presence in China, and they are far behind features wise.
    - saurik 4y ago
      You make it sound like iMessage won... is that true?! Most of the people I know use some combination of (Facebook) Messenger, whatever you want to call the thing in Instagram (which is now compatible with Messenger), WhatsApp (or some Signal), and even Twitter DMs (which surprises me to no end)... there are only a few people I ever talk to with iMessage anymore. Some people use Telegram (but those people are more techie; the "normal" people I know are on the Meta apps... maybe they are also on TikTok but I'm too old to talk to them ;P). Meanwhile, iMessage seems to be frantically trying to throw in features from Messenger and WhatsApp in order to remain competitive (and then doesn't even do them as well).
_Algernon_ 4y ago
If the client is closed source, and developed by an untrustworthy company, e2ee doesn't matter.
- londons_explore 4y ago
  I disagree. Even a closed source client soon has opensource 'compatible' clients. To build those, you need to reverse engineer/understand the crypto. In the process of doing that, you will likely uncover any systemic flaw that reveals every conversation to a passive attacker. That effectively leaves the 'send a secret message to leak the key' type backdoors that the client could have. However, if this functionality existed and was used on every chat, then it is quickly discovered by anyone debugging the unofficial client. So the only remaining 'loophole' is that there is a backdoor in the official client, but that it is only used very rarely or on request. That in turn means that facebook can't go do large scale data mining on the private chats. Thats a win.
  - Y_Y 4y ago
    When had anyone reverse engineered their way to a compatible client for FB Messenger or WhatsApp? To my knowledge there are only hacky bridges that involve running the official client under the hood.
    - londons_explore 4y ago
      [1] is that for whatsapp. It implements everything from scratch, including the crypto and all the many layers of message encapsulation. I believe there are a few other clients too. It even implements the API's to create a new account, so you don't even need to touch their client code at all. FB messenger doesn't yet have e2e encryption, so there hasn't yet been any need. [1]: https://github.com/tgalal/yowsup https://github.com/tgalal/yowsup
      - deleted 4y ago
        [deleted]
      - 4y ago
EGreg 4y ago
Active Status: Let people see when you’re active, so they know when it’s a good time to call. You can also choose to turn this feature off, if you want to improve your privacy. Why is calling still a thing? It interrupts whatever the person was doing. And just KNOWING that any one of your 5000 contacts can call you at any time can be very distracting and make you anxious subciously. What is wrong with async scheduling meetings? And threaded conversations? I can understand read receipts but online status is silly. It only enables stalking. Why not have people bid for your timeslots and fill up classes and office hours etc.? Everyone would have a happier life.
- noptd 4y ago
  Seriously. Nothing like normalizing the gathering and (by default) over-sharing of sensitive data with your product...
  - EGreg 4y ago
    Yup, that’s what Facebook’s business model seems to always dip into.
- teddyh 4y ago
  Wait until you hear about doorbells.
  - EGreg 4y ago
    Pretty sure having to travel to my door is a good filter of effort that is lacking online. I wonder whether the people downvoting me are all guys, or really don’t mind spam.
anonym29 4y ago
Out of curiosity here, does anyone trust that Facebook is actually implementing proper E2EE, between two users, with no key interception / logging, and not just as some marketing gimmick where they actually mean that the connection between your device and the Facebook server is "end-to-end encrypted"? Call me jaded, call me cynical, but at this point, I do not trust a single word that corporation prints regarding privacy.
- super256 4y ago
  Why should we assume that they are handling encryption in Messenger different from encryption in WhatsApp?
  - NayamAmarshe 4y ago
    On the other hand, why should we assume WhatsApp's E2EE is 100% like the double ratchet spec and not 90% or even 50%? No one knows if WhatsApp implements E2EE correctly and does not do anything funny with your data. As long as that remains unproven due to the closed source binary we should never assume WhatsApp's E2EE is 'good enough'. It's also Facebook so you know half the story already.
  - anonym29 4y ago
    Personally, I don't assume they're implemented differently - I use neither because I don't trust closed source code, I don't trust big tech corporations like FB, and I definitely do not trust closed source code from big tech corporations like FB. Mind you, I say this as someone who audits closed source code at a big tech corporation as a profession - someone who deliberately avoids using a single piece of closed source software developed by their employer on any personal devices despite it being ubiquitous and in widespread use.
apatheticonion 4y ago
I'd prefer it if Facebook implemented more features into Messenger - like broader text formatting support, better media management, better search capabilities OR at least give us an API to write our own clients on top of the Messenger infrastructure.
HelixEndeavor 4y ago
Overall pretty meaningless coming from Facebook. They'll still collect all the metadata they want. The only theoretical benefit this offers to the user is in the event of a massive Messenger data breach, at least the contents of user messages won't be leaked. Which I guess is some comfort, to somebody?
monicaincog 4y ago
do you trust faceboook ?

59 points by thm 4y ago

So is this liability reduction for them? Too many subpoenas and this makes responding to them more efficient? It doesn't seem like "messenger is e2e encrypted" actually matters for marketing and adoption so either it is a cheap fiction for marketing or there is a motive I don't understand.

baby 4y ago
IMO the value comes in this order: 1. liability reduction 2. interop with WhatsApp 3. marketing 4. added security for their users :D
- 56friends 4y ago
  #2 is interesting. I am very curious what the ultimate plan for having 2 messaging apps is (at least in Zuck’s head). My bet is that his fantasy is to eventually merge them into a single service: Meta Messenger.
  - baby 4y ago
    Yeah I believe the plan for interop has been public for years now
    - i67vw3 4y ago
      FB messenger is largely used in US. In non-US countries everyone uses Whatsapp. If they drop whatsapp to combine both of them, it will have quite serious effects and completely ruin the whole 'thing'.
      - baby 4y ago
        interop is not about dropping one over the other, it's about being able to talk to messenger user through whatsapp
      - 56friends 4y ago
        They could do this very gradually. First rename WhatsApp to Meta Messenger. Keep everything else the same. Then with interop being implemented slowly merge FB messenger into Meta Messenger.

teddyh 4y ago

Does is pass the mud puddle test?

capableweb 4y ago
That's a joke anyways. Regardless if Facebook can/will/wont/pretend to not being able to give you your data back, they could store it.

atonse 4y ago

Curious as to why they suddenly seem to care about adding E2E? I wonder if, with ML models running on devices now, they've found a way to show relevant-enough ads by doing all the "relevancy" processing on-device, at one of the "ends" of the encrypted chat. It just doesn't add up.

tapoxi 4y ago
Probably because their main competitor, iMessage, is E2E. If they can be E2E and cross-device, they can take share from Apple.
- baby 4y ago
  BTW, iMessage is not their main competitor (or even comparable to a non-text message cross-platform messaging app). IMO that was messaging from Facebook to avoid antitrust issues. Their main competitors are telegram, wechat, kakao.
  - JumpCrisscross 4y ago
    In the U.S., the competition is Discord; overseas, WeChat, QQ, Snapchat and Telegram [1]. iMessage is a tool for the rich or young [2]. [1] https://spectrm.io/insights/blog/messaging-app-statistics-most-popular-communication-method-2020/ https://spectrm.io/insights/blog/messaging-app-statistics-mo... [2] https://www.androidauthority.com/imessage-big-deal-guide-3087606/ https://www.androidauthority.com/imessage-big-deal-guide-308...
- masterof0 4y ago
  I agree with baby here, iMessage ate their lunch long ago,their competition is Kakao, Line, and the likes, not even Wechat, as they have 0 presence in China, and they are far behind features wise.
  - saurik 4y ago
    You make it sound like iMessage won... is that true?! Most of the people I know use some combination of (Facebook) Messenger, whatever you want to call the thing in Instagram (which is now compatible with Messenger), WhatsApp (or some Signal), and even Twitter DMs (which surprises me to no end)... there are only a few people I ever talk to with iMessage anymore. Some people use Telegram (but those people are more techie; the "normal" people I know are on the Meta apps... maybe they are also on TikTok but I'm too old to talk to them ;P). Meanwhile, iMessage seems to be frantically trying to throw in features from Messenger and WhatsApp in order to remain competitive (and then doesn't even do them as well).

_Algernon_ 4y ago

If the client is closed source, and developed by an untrustworthy company, e2ee doesn't matter.

londons_explore 4y ago
I disagree. Even a closed source client soon has opensource 'compatible' clients. To build those, you need to reverse engineer/understand the crypto. In the process of doing that, you will likely uncover any systemic flaw that reveals every conversation to a passive attacker. That effectively leaves the 'send a secret message to leak the key' type backdoors that the client could have. However, if this functionality existed and was used on every chat, then it is quickly discovered by anyone debugging the unofficial client. So the only remaining 'loophole' is that there is a backdoor in the official client, but that it is only used very rarely or on request. That in turn means that facebook can't go do large scale data mining on the private chats. Thats a win.
- Y_Y 4y ago
  When had anyone reverse engineered their way to a compatible client for FB Messenger or WhatsApp? To my knowledge there are only hacky bridges that involve running the official client under the hood.
  - londons_explore 4y ago
    [1] is that for whatsapp. It implements everything from scratch, including the crypto and all the many layers of message encapsulation. I believe there are a few other clients too. It even implements the API's to create a new account, so you don't even need to touch their client code at all. FB messenger doesn't yet have e2e encryption, so there hasn't yet been any need. [1]: https://github.com/tgalal/yowsup https://github.com/tgalal/yowsup
    - deleted 4y ago
      [deleted]
    - 4y ago

EGreg 4y ago

Active Status: Let people see when you’re active, so they know when it’s a good time to call. You can also choose to turn this feature off, if you want to improve your privacy. Why is calling still a thing? It interrupts whatever the person was doing. And just KNOWING that any one of your 5000 contacts can call you at any time can be very distracting and make you anxious subciously. What is wrong with async scheduling meetings? And threaded conversations? I can understand read receipts but online status is silly. It only enables stalking. Why not have people bid for your timeslots and fill up classes and office hours etc.? Everyone would have a happier life.

noptd 4y ago
Seriously. Nothing like normalizing the gathering and (by default) over-sharing of sensitive data with your product...
- EGreg 4y ago
  Yup, that’s what Facebook’s business model seems to always dip into.
teddyh 4y ago
Wait until you hear about doorbells.
- EGreg 4y ago
  Pretty sure having to travel to my door is a good filter of effort that is lacking online. I wonder whether the people downvoting me are all guys, or really don’t mind spam.

anonym29 4y ago

Out of curiosity here, does anyone trust that Facebook is actually implementing proper E2EE, between two users, with no key interception / logging, and not just as some marketing gimmick where they actually mean that the connection between your device and the Facebook server is "end-to-end encrypted"? Call me jaded, call me cynical, but at this point, I do not trust a single word that corporation prints regarding privacy.

super256 4y ago
Why should we assume that they are handling encryption in Messenger different from encryption in WhatsApp?
- NayamAmarshe 4y ago
  On the other hand, why should we assume WhatsApp's E2EE is 100% like the double ratchet spec and not 90% or even 50%? No one knows if WhatsApp implements E2EE correctly and does not do anything funny with your data. As long as that remains unproven due to the closed source binary we should never assume WhatsApp's E2EE is 'good enough'. It's also Facebook so you know half the story already.
- anonym29 4y ago
  Personally, I don't assume they're implemented differently - I use neither because I don't trust closed source code, I don't trust big tech corporations like FB, and I definitely do not trust closed source code from big tech corporations like FB. Mind you, I say this as someone who audits closed source code at a big tech corporation as a profession - someone who deliberately avoids using a single piece of closed source software developed by their employer on any personal devices despite it being ubiquitous and in widespread use.

apatheticonion 4y ago

I'd prefer it if Facebook implemented more features into Messenger - like broader text formatting support, better media management, better search capabilities OR at least give us an API to write our own clients on top of the Messenger infrastructure.

HelixEndeavor 4y ago

Overall pretty meaningless coming from Facebook. They'll still collect all the metadata they want. The only theoretical benefit this offers to the user is in the event of a massive Messenger data breach, at least the contents of user messages won't be leaked. Which I guess is some comfort, to somebody?

monicaincog 4y ago

do you trust faceboook ?