19 ms·

Building end-to-end security for Messenger

• yedava 3y ago
  Here's a hard problem that I would like the world's highest paid people to solve: Give us an app where everything, including metadata, is end-to-end encrypted and works at "web scale". No one other than the people in the conversation can know who is talking to who and when. Then figure out a way to pay the bills to run the infrastructure and pay the people working on the app and also make a profit. (A novel idea: Maybe charge people to use the app?)
  • deleted 3y ago
    [deleted]
  • darig 3y ago
    [dead]
  • freedomben 3y ago
    The everything encrypted is a hard one, but should be doable so long as the incentives are right. For example, the money needs to be paid by the users for the product, and to keep it fully encrypted. It needs to be clear that not only is there no incentive to sell data or mine for ads, but doing so is a disincentive because it would actually lead to customer loss. If I could raise enough money to replace my dayjob, I would totally do this. I'm guessing it's not doable, but I put together a quick Google Form to gauge interest. If anyone would be interested, please submit the form[1] [1] https://docs.google.com/forms/d/e/1FAIpQLSe1sl5MI1Mxna6RBTXB4mqxAVo5TvF38zz4Hp7K9aKEVHfZDw/viewform?usp=sf_link https://docs.google.com/forms/d/e/1FAIpQLSe1sl5MI1Mxna6RBTXB...
  • phocion 3y ago
    Doesn't Signal do all of this, minus the profit? > Maybe charge people to use the app? Who will pay for a service that's offered for free by at least 3 major messaging apps?
    • esafak 3y ago
      I pay for Signal. I used to pay for WhatsApp, before it was acquired. Not many users are like me, granted.
    • jszymborski 3y ago
      I'm not aware how to anonymously use Signal in any meaningful way but there might be some way.
      • contact9879 3y ago
        Anonymity isn't necessary. e.g. Briar isn't anonymous (you still need to trust your contacts), but it's essentially impossible for third-parties to track who is talking to who and when.
      • sneak 3y ago
        Use it via a VPN and with a telephone number that is not associated with your identity. This is what I do.
        • lxgr 3y ago
          That's pseudonymity, not anonymity. Signal doesn't allow creating multiple identities for different contexts (without using multiple phones). And depending on your personal risk profile (e.g. journalists protecting their sources), phone numbers are extremely difficult to acquire anonymously in many countries. In most EU countries, you need to show photo ID to register prepaid SIM cards these days.
          • sneak 3y ago
            You don’t need to acquire a phone number from the country you’re in. Any phone number works on Signal. There’s no long distance. In EU countries you can easily and anonymously get a US number via the internet that works fine on Signal. There is no requirement that the SIM card in your phone be the number you use to register on Signal, or that the number even be a GSM number. My Signal number is a Google Voice number, for example. Anyone with access to a US GSM number can create these; many are for sale for anonymous payment methods. It’s easy to use Signal anonymously in any country that has mostly uncensored internet.
  • michaelsbradley 3y ago
    It may not check all of your boxes, but the waku protocol and applications’ use of it have been evolving since 2018: https://waku.org/ https://waku.org/ https://github.com/waku-org/nwaku https://github.com/waku-org/nwaku
  • nirav72 3y ago
    Even harder problem is getting the average user to care about things like end-to-end encryption. Let alone getting them to pay for it. Thats why services like Signal are not in the majority.
    • deleted 3y ago
      [deleted]
    • poisonborz 3y ago
      Give it a decade or two. The increasing amount of things we store digitally and the risk of exposure or losing them rises day by day, with it the amount of people who were credit scammed, crypto stolen, bully sharing explicit images etc, not speaking of scandals like Meta had. Not long ago people didn't care about their home being energy efficient either.
  • blackoil 3y ago
    Who wants this? All the effort and few thousand users paying 20 USD / year doesn't make much profit. The world is happy with the encryption WhatsApp provides and would have been happy even if that wasn't there.
    • toomuchtodo 3y ago
      Also iMessages. 135M users in the US.
      • Dah00n 3y ago
        It also isn't really encrypted. The really juicy bits (metadata) is available for Apple to read as it sees fit.
  • beefsack 3y ago
    It seems really straightforward to suggest that the better way to solve this is with standard protocols and self-hosting, but I do realise that's quite hand wavy and often not very accessible. SMTP is an example of this succeeding, as problematic as that protocol is.
  • temporalparts 3y ago
    It's not possible to have a "web scale" that end-to-end encrypts metadata, because part of the metadata is understanding the recipient. If the network or server has no idea where to deliver an encrypted message, then the only way to guarantee delivery is to send all the messages to all the users to unpack to see which ones are relevant to them, which fails "web scale"
    • hamandcheese 3y ago
      What if all inboxes were public, but only decryptable by the recipient? Recipient can then poll for new messages.
      • ThatPlayer 3y ago
        Only the recipient would be able receive/send messages from that inbox. So you can easily match inbox to the recipient.
        • eru 3y ago
          You wouldn't send via your inbox. And anyone would be able to download any inbox, the data would just be useless without the key. There might be problems with the proposed model, but they aren't the problems you suggested. (As an individual, you wouldn't want to download just your own inbox. But to obfuscate, you can download a random subset of inboxes that often-enough includes your own.)
          • ThatPlayer 3y ago
            And that's not something I want to have to do: download random inboxes on a limited phone data plan. As a polled service, how many times do you have a poll a minute? If I'm instant messaging, I could be pulling multiple times a seconds. How many more inboxes would I have to poll at the same time to obfuscate my actual inbox? And if you want to be anonymous you can't filter by the last message you've received, so every time you pull your inbox, you're getting the last X time in messages. So if I have multiple active group chats, that would really start to add up. Videos and images like every other messaging service would have to be anonymized the same way. Even 10x noise polling for a 10MB video would be too much data on phones and probably not enough to anonymous. How about obfuscating the sender? Would a sender be uploading 10x trash, not just text but also video, messages in every inbox?
  • bee_rider 3y ago
    A non-free messenger app seems pretty challenging because * there’s lots of free competition, including Signal, which is free and decent. * you’d probably need to open source it if you want to convince anyone it was trustworthy * what if you want to message somebody that doesn’t want to pay? Of course maybe a huge company could work this out… but it seems fundamentally very hard
  • contact9879 3y ago
    Briar gets most of the way. And Cwtch gets all the way (except maybe the pay the people working on it). Any sort of project that actively tries to minimize data collection will not be profitable. At least not in this current economic system. They will have to be non-profit (Signal, etc), or run by volunteers (Cwtch, Briar).
  • deleted 3y ago
    [deleted]
  • miloignis 3y ago
    I'd love something like the Matrix [0] data model (JSON messages aggregated in an eventually-consistent chatroom CRDT) transmitted over something like simplex for metadata resistance. [0] https://matrix.org https://matrix.org [1] https://simplex.chat/ https://simplex.chat/
  • ThatPlayer 3y ago
    The #1 thing that sounds impossible is how do tie a payment to an account anonymously? Unless you only take anonymous payments, you end up putting a credit card number on every account. >No one other than the people in the conversation can know who is talking to who and when. This also means the infrastructure cannot block messages. Or tell the difference between spam and legit messages. Effectively you can DDoS a client with messages.
    • eru 3y ago
      > This also means the infrastructure cannot block messages. Or tell the difference between spam and legit messages. Effectively you can DDoS a client with messages. Not necessarily. Eg as a simple model, assume that you 'send' a message by publishing it to something like a usenet group (and perhaps that group charges you a fraction of a cent for doing so). There's no denial-of-service for a client that receives a lot of messages, distributed or otherwise, but still outsider don't see who is sending what to whom.
  • aspenmayer 3y ago
    > Veilid is a peer-to-peer network and application framework released by the Cult of the Dead Cow on August 11, 2023, at DEF CON 31. Described by its authors as "like Tor, but for apps", it is written in Rust, and runs on Linux, macOS, Windows, Android, iOS, and in-browser WASM. VeilidChat is a secure messaging application built on Veilid. https://en.wikipedia.org/wiki/Veilid https://en.wikipedia.org/wiki/Veilid > Veilid is an open-source, peer-to-peer, mobile-first, networked application framework. > The framework is conceptually similar to IPFS and Tor, but faster and designed from the ground-up to provide all services over a privately routed network. > The framework enables development of fully-distributed applications without a 'blockchain' or a 'transactional layer' at their base. > The framework can be included as part of user-facing applications or run as a 'headless node' for power users who wish to help build the network. https://veilid.com/ https://veilid.com/ https://gitlab.com/veilid/veilid https://gitlab.com/veilid/veilid https://veilid.com/discord https://veilid.com/discord https://youtube.com/watch?v=Kb1lKscAMDQ https://youtube.com/watch?v=Kb1lKscAMDQ > VeilidChat is a chat application written for the Veilid distributed application platform. It has a familiar and simple interface and is designed for private, and secure person-to-person communications. https://veilid.com/chat/ https://veilid.com/chat/ https://gitlab.com/veilid/veilidchat https://gitlab.com/veilid/veilidchat Previously: Veilid is an open-source, P2P, mobile-first, networked application framework 180 points 4 months ago 71 comments https://news.ycombinator.com/item?id=37118124 https://news.ycombinator.com/item?id=37118124 Cult of the Dead Cow wants to save internet privacy with new encryption protocol 141 points 4 months ago 79 comments https://news.ycombinator.com/item?id=37018404 https://news.ycombinator.com/item?id=37018404 https://gizmodo.com/cult-of-the-dead-cow-launches-veilid-encryption-project-1850699803 https://gizmodo.com/cult-of-the-dead-cow-launches-veilid-enc...
  • greentea23 3y ago
    Two projects that are trying: https://github.com/simplex-chat/simplex-chat https://github.com/simplex-chat/simplex-chat https://github.com/oxen-io/session-android https://github.com/oxen-io/session-android
  • upofadown 3y ago
    This is doable and has been done. Briar is an example. The Tor network is used for transport and there is no central server. Even the clients don't know who is talking to who, everything is done in terms of the crytographic identity number. That means that even the users don't for sure know who they are talking to; as part of the introduction to someone you have to give the name you will know them by. The Briar way of doing things actually solves an important E2EE usability issue. Since the cryptographic identity is the only identity, it is much harder for the user to end up using the system without a verified identity.
• ClassyJacket 3y ago
  Doesn't this mean a bunch of features that run on the server have to be removed, like searching message history - which I use all the time?
  • tinytuna 3y ago
    By default yes but you can always disable it
    • contact9879 3y ago
      E2EE won't be disable-able
      • egberts1 3y ago
        You meant EE2E, a more favorable privacy form than E2EE.
        • iknowstuff 3y ago
          What?
  • contact9879 3y ago
    Usually yes, but check out their Labyrinth implementation which might mean the answer for most features is no.
    • ngrilly 3y ago
      I just read the white paper, and I haven't seen anything about search, which would require some kind of homomorphic encryption, but I think that's pretty much an unsolved problem: for example, to be able to search message content in Proton Mail, you need to enable the creation of a local search index — it's not done server-side, which means all the messages have to be downloaded locally to be indexed.
  • nullandvoid 3y ago
• walterbell 3y ago
  > Message contents are authentically and securely transmitted between your devices and those of the people you’re talking to. This is, perhaps, the primary goal of E2EE, and is where much E2EE research and design work is targeted, such as the Signal protocol we use in our products (such as WhatsApp, Messenger, and Instagram Direct), or the IETF’s Messaging Layer Security protocol, which we helped to design and was recently standardized. Will Messenger eventually use IETF MLS?
  • contact9879 3y ago
    I imagine somewhere in the planning stages is complying with DSA by adopting MLS and allowing interoperability between WhatsApp and FB/Insta Messenger and other services.
    • lxgr 3y ago
      Messenger/Facebook and Instagram interoperability is apparently being discontinued: https://help.instagram.com/654906392080948 https://help.instagram.com/654906392080948
      • contact9879 3y ago
        oh wow, so will E2EE apply to Instagram too? or just Messenger? Edit: nvm just read the last paragraph of the post
• anonym29 3y ago
  Just to be clear though, Messenger is still closed-source, so this all still gets lumped into the "source: trust us" bucket, no?
  • TillE 3y ago
    There's no process for verifying that a particular binary is built from known source code, or that the source code lacks any sneaky back doors. The gold standard is and probably always will be analyzing the binary itself, with disassemblers, debuggers, etc.
    • gorgoiler 3y ago
      Or reproducible builds to prove that the app I downloaded from the Apple walled garden matches the one I built myself from this known-good source code.
      • gruez 3y ago
        It's not even possible to extract the executable without jailbreaking
        • eru 3y ago
          You wouldn't actually need to extract the executable for reproducible builds to be useful. You could also just have the ability for your phone to reliably tell you the hash of the executable, without giving you the executable itself.
          • lxgr 3y ago
            Why would you trust the hash function if you don't trust the rest of the platform?
            • eru 3y ago
              This assumes you trust eg Apple (to a certain degree, eg to have their hardware provide legitimate hashes, but eg not to just run a messaging services), but you want to avoid also having to trust Meta. More generically: you might trust that a company can do the Right Thing now (or at most points in time), but you avoid having to trust that they always do the right thing at all points in time. See how Apple famously could refuse to give law enforcement access to people's phones, because Apple deliberately designed their systems in such a way to remove that ability from their future selves. Similarly, a company that doesn't keep any logs, can't be forced in the future to divulge those logs. They can be forced to start keeping logs, and then be forced to divulge those. But doesn't work retro-actively and is still one extra hoop for the forcing party to jump through. And perhaps you can even set up matters such that adding this vulnerability can't easily be done in private.
• advisedwang 3y ago
  The white paper "Server-Side Message Storage" section links to a google doc, labelled as "draft" and with no public access. Should that point to https://engineering.fb.com/wp-content/uploads/2023/12/TheLabyrinthEncryptedMessageStorageProtocol_12-6-2023.pdf https://engineering.fb.com/wp-content/uploads/2023/12/TheLab...? Pretty poor review.
  • lxgr 3y ago
    The real link is https://engineering.fb.com/wp-content/uploads/2023/12/TheLabyrinthEncryptedMessageStorageProtocol_12-6-2023.pdf https://engineering.fb.com/wp-content/uploads/2023/12/TheLab.... I also stumbled over that; only the link from the other whitepaper is broken, the one on the parent page works.
    • alex_smart 3y ago
      Can I just say that I am a little surprised that their engineering blog is hosted on wordpress?
      • notRobot 3y ago
        Why? Afaik all Microsoft blogs are hosted on WordPress too. Everyone uses WordPress.
      • alexgartrell 3y ago
        As a Meta employee, I consider this a victory against NIH :)
      • blowski 3y ago
        Wordpress is pretty big in enterprise blog-like sites, with their WordPress VIP offering.
      • rmccue 3y ago
        As someone who runs an enterprise WordPress host, Facebook aren’t that surprising - loads of large organisations use WordPress either within their marketing department, or as their “second CMS” (AEM is very often the primary). We’re still seeing adoption growing too.The ones that might surprise you are banks and other financial institutions :) Ultimately, WordPress is as secure as any other piece of software, but the ecosystem is so large and varied that there’s a low bar for many add-on plugins. A lot of enterprises build their own plugins for that reason, rather than using the full power of the ecosystem. (Disclaimer: I’m also a member of the WordPress security team, but not speaking on behalf of them.)
• tech234a 3y ago
  Possibly related: Meta is removing cross-platform chats between Instagram and Messenger [1]. [1]: https://news.ycombinator.com/item?id=38528306 https://news.ycombinator.com/item?id=38528306
  • Obscurity4340 3y ago
    What are the implications?
    • rvnx 3y ago
      Daily active users are going to grow on both platforms. Let's consider you have Instagram users on one-side, and Facebook users on one-side. As long as you have at least one contact using only Facebook (like your parents), then you have to be active on both platforms in order to talk to your contacts. If the two platforms would be unified, then you would be active only on Instagram for example.
      • RonnieOwnsLexus 3y ago
        or you would leave one of them.
  • lxgr 3y ago
    Interesting, I thought the plan was to finally make all three Meta messengers interoperable with end-to-end encryption. I wonder what changed. Maybe testing showed that people actually prefer them to be separate?
    • disgruntledphd2 3y ago
      That was an insane idea that was only put forward as a hedge against someone breaking them up.
    • Moldoteck 3y ago
      Imo maybe it's bc of eu regulations
• egberts1 3y ago
  Is it a true EE2E where data at rest in the Facebook server remains encrypted and keys held only by the sender/receiver? I didn't think so.
  • contact9879 3y ago
    What? That's exactly what this is.
    • egberts1 3y ago
      Meanwhile too many Facebook fans are downvoting me. This should age well.
• zxt_tzx 3y ago
  There’s probably an anti-competition angle here: with end-to-end encryption, you need a trusted central authority to distribute the public keys, which would make interoperability across different messaging services more difficult (impossible?), something that regulators have been trying to make happen. If I owned the largest messaging networks, I would enable end-to-end encryption by default too.
• wayfinder 3y ago
  Note that most E2E encryption services still let the service read your messages. Apple, Facebook, etc. can still read your messages. This is because encryption needs keys, but when you talk to your friend over these services, under no point did you personally exchange any keys. This means that you’ve decided to let the service generate and keep the keys for you. It’s like getting a deposit box at the bank but instead of keeping your key, you give your key to the bank to keep. What would stop the bank from opening your box would be its own ethics policy and the quality and depth of their internal processes. They are not physically prevented from bypassing them however. It’s still a W with these rudimentary E2E chat implementations because your ISP and government might find it a lot more difficult to read but it’s not quite exactly super strong security.
  • eru 3y ago
    The keys could be generate on the devices and never leave them. Of course, if the software is not open source, that's hard to police. But abstracting away the key generation from the user doesn't mean that the services can read your messages.
  • contact9879 3y ago
    I know the argument is somewhat moot because they're all closed source. But with WhatsApp and Apple shipping key transparency, this isn't necessarily true anymore. You can verify that the keys that were given to your contacts are the keys that were generated on your device without needing to meet in person.
    • seanieb 3y ago
      WhatsApp shipped key transparency before Apple. I assume FB will follow.
  • valleyer 3y ago
    Apple says that iMessage uses asymmetric encryption, the private key of which is stored only on device. You can choose to believe they're lying, I guess, but what they are describing is indeed possible. https://support.apple.com/guide/security/imessage-security-overview-secd9764312f/web https://support.apple.com/guide/security/imessage-security-o...
• contact9879 3y ago
  The whitepapers: Messaging: https://engineering.fb.com/wp-content/uploads/2023/12/MessengerEnd-to-EndEncryptionOverview_12-6-2023.pdf https://engineering.fb.com/wp-content/uploads/2023/12/Messen... Labyrinth E2EE storage: https://engineering.fb.com/wp-content/uploads/2023/12/TheLabyrinthEncryptedMessageStorageProtocol_12-6-2023.pdf https://engineering.fb.com/wp-content/uploads/2023/12/TheLab... --- Comments by: Jon Millican https://twitter.com/JonMillican/status/1732582565884702982 https://twitter.com/JonMillican/status/1732582565884702982 Matt Green https://twitter.com/matthew_d_green/status/1732567051607089348 https://twitter.com/matthew_d_green/status/17325670516070893... Alec Muffet https://alecmuffett.com/article/108588 https://alecmuffett.com/article/108588
• gnabgib 3y ago
  More discussion (different URL, similar content) of "Launching Default End-to-End Encryption on Messenger"[0] (59 points, 3 hours ago, 55 comments) [0]: https://news.ycombinator.com/item?id=38551993 https://news.ycombinator.com/item?id=38551993
  • dang 3y ago
    Thanks - although that one was posted earlier, the OP here seems to have the more informative article, so I guess we'll merge those comments hither.
• ehPReth 3y ago
  ahhh, that's why it forced me to set a PIN! I wonder what percentage of people will forget theirs
  • rvnx 3y ago
    If it's a 6-digits PIN, computers are going to find it easy to break.
    • lxgr 3y ago
      This can somewhat plausibly done in a relatively secure way using HSMs: https://engineering.fb.com/2021/09/10/security/whatsapp-e2ee-backups/ https://engineering.fb.com/2021/09/10/security/whatsapp-e2ee... That approach puts a lot of trust in the HSM vendor, though.
• papaver-somnamb 3y ago
  Progress that is highly welcome, to be sure. But what about Trust? In a world of continuous data breaches, exfiltrations, malicious Three-Letter Agencies, incompetent and decades-behind-the-curve legislators, trust is a paramount factor. Trust that a given communication system's first allegiance is to the interlocutors(A), trust that my data won't be subjected to surveillance capitalism, trust that it won't be stripped mined for reflecting advertising right back at me for useless shit I don't want, trust that I can speak my mind without needing to continuously look over my shoulder with one eye pealed for powercenter goons sicked on me by partisan logic. If you want me to trust your system, show me the complete source code, show me the disinterested third-party security reviews, show me what can happen at the ends, show me that it's not compromised by secrecy laws, along the full chain of custody. A problem for our age, one step at a time .. A) See? Even this assumption is a cardinal mistake! Edit: Trust, but verify. Trust needs to be earned.
  • salil999 3y ago
    > If you want me to trust your system, show me the complete source code I think this is a bit extreme and not really plausible for something like messenger at its scale.
  • gretch 3y ago
    >If you want me to trust your system, show me the complete source code Sounds like you set yourself up to never trust anything. I mean, do you fly on airplanes without having inspected the flight code? Or do you put your money in a bank without having inspected the accounting code?
    • sverhagen 3y ago
      I don't think it's necessary for everyone to fully review the complete source code themselves. But having it available for applications at a serious enough scale, would allow the community at large to proof the vendor's claims about secure encryption. And at Facebook scale I would be satisfied that I'd hear about it if the encryption turned out to be a lie.
    • Biganon 3y ago
• xvector 3y ago
  Meta gets a lot of flak for privacy, but at the same time, they end to end encrypt the majority of communication happening globally (Whatsapp+Messenger), at cost to the company, with no obligation to do so.
  • lloeki 3y ago
    > at cost to the company If by "cost" you mean Meta being in the business of siphoning user behaviour, Meta controls the E in E2E a.k.a the apps, so it's a matter of trusting them to not do covert on-device analysis + result exfiltration.
    • xvector 3y ago
      Plenty of people have reverse-engineered the apps and found no evidence of this. They use the same protocol as Signal under the hood. Many cybersecurity engineers passionate about this stuff have worked for Meta. They, too, would have blown the whistle at some point.
      • lloeki 3y ago
        The E2E protocol is immaterial, it's about what the endpoint app does and which telemetry it reports. Not saying they do it, again it's about trust in the context of: - Meta (the company, not the employees) having a bad track record - Meta's business model being what it is (building profiles and selling tooling around that), creating tension with privacy matters
        • xvector 3y ago
          Their track record with E2EE is pretty great, given that they opt to disable WhatsApp in countries that ban E2EE instead of disabling E2EE.
  • drsnow 3y ago
    No company is obligated to do anything. Such lack of obligation is not sufficient reason to praise companies that do the bare minimum to keep user data safe. Sure they aren't obligated but how on earth does that matter?
• evbogue 3y ago
  Where do I find my private key?
  • contact9879 3y ago
    well, first, which one? and second, somewhere in your Android or iOS keystore
    • evbogue 3y ago
      Link?
      • contact9879 3y ago
        Android developer docs and the whitepapers linked in this post
• purpleidea 3y ago
  This is at the same time as they've announced they're getting rid of encrypting their outgoing messages with PGP! (If you add your public key of course!) I was always very impressed by this-- every service that sends emails should support this. Even banks don't!
  • yellow_lead 3y ago
    This is because hackers were using this to lock people out of their own accounts. They would add a PGP key and then the user could no longer read any emails from FB to recover their account. There are maybe alternative solutions, but it's not a bad reason to remove it IMO.
    • kevincox 3y ago
      This seems like a pretty dumb reason. If they can set the PGP key they can also change the email. If the account recovery team allows access to recently removed emails as part of the recovery process then it should also allow contacting those addresses without a recently added PGP key. Logically adding a PGP key is equivalent to changing the email, the previous person can't access the messages anymore. If the recovery process handles these cases differently it is a flaw in the process.
• salil999 3y ago
  I am curious why it was very difficult for messenger to implement E2EE by default. iMessage has been doing it* (with a giant asterisk because there are flaws in the way Apple markets its E2E on iMessage but in general it has something there). The implementation they're describing on the blog seems very similar to iMessage (keys stored on a server so that syncing is possible Asides from iMessage, they pretty much have most of this working for WhatsApp from the perspective of the user. The challenges they've mentioned seem like they've mostly been solved in WhatsApp? I could be totally naive here though.
  • evbogue 3y ago
    If the keys are stored on the server, how is that a private message?
    • zer0zzz 3y ago
      Protonmail holds your key encrypted on the server. The key could be encrypted+decrypted by pin or by password.
      • Dah00n 3y ago
        Does Proton (or Meta) see that Pin or password, or is it client-side only (as far as we know)?
        • pferde 3y ago
          Client side. The client downloads the encrypted key backup and decrypts it using user-entered pin/password.
  • contact9879 3y ago
    Enabling E2EE has historically required usability tradeoffs (no multi-device, no backups, chat transcripts are stored on device only, etc). It took them this long to make it seamless.
    • 3y ago
• TriangleEdge 3y ago
  I knew a guy that used deep packet inspection in a service[1]. He told me that back in ~2016, when using WhatsApp, the text was encrypted but nothing else was. If you sent a picture, it was in clear text. I don't know if this is still true, but because of this, I have serious doubts about anything security related coming out of FB. [1] Being intentionally vague here as to not dox him.
  • losteric 3y ago
    WhatsApp was/is heavily scrutinized, and it's fairly easy to sniff your own network traffic. It's unlikely that "some guy" and no one else discovered that WhatsApp was not encrypting content.
• captn3m0 3y ago
  Their history approach is interesting, supporting key rotations as well. However, metadata is still un-encrypted, same as on whatsapp. Meta knows who you talk to, and when - this is juicy enough for both ad-targeting, and government surveillance.
  • nicce 3y ago
    Exactly. This is pure marketing. "Normal" people do not know the difference and there is greater chance that they stay in Meta apps instead of switching.
  • m463 3y ago
    Also I believe they create an id on device for the media and can identify (known) images are going back and forth. Don't know why they couldn't use this for targeting even though "the data is encrypted"
    • deleted 3y ago
      [deleted]
  • pnt12 3y ago
    I think this is a next step we must demand after everyone gets on board with E2E messaging. Metadata is still data!
    • nicce 3y ago
      I would say that people have currently major misunderstanding between what is more important. Let's imagine a situation where all the messages from Meta's platforms are leaked. On other scenario message content is plaintext, but senders, receivers, timestamps and locations are encrypted (on top of app usage behaviour). On the other scenario, all the contents are encrypted, but the metadata is public. We would know to whom everyone, in anytime, in any location, in which interval has talked to. Which is more dangerous or damaging?
  • joshspankit 3y ago
    As a thought experiment, I’m interested in people listing metadata that fits the legal definition and teasing out types that the public would probably not think is metadata. I’ll start first off the top of my head: - The (real) identity of you and every person you talk to - The time of the messages - The location they were sent from - The specific device used to send them - A sentiment analysis: were the messages positive? Negative? Depressed? Anxious? Sarcastic? - A description of the pictures that were sent (for example by an on-device AI model) - A transcript of any voice memos/videos
• dang 3y ago
  Related: https://messengernews.fb.com/2023/12/06/launching-default-end-to-end-encryption-on-messenger/ https://messengernews.fb.com/2023/12/06/launching-default-en... (via https://news.ycombinator.com/item?id=38551993 https://news.ycombinator.com/item?id=38551993, but we merged that thread hither).
• laserbeam 3y ago
  I can never get excited about E2EE encryption... It's not because it isn't important, it's because while I've lived I've had 2 phones die in my hands, 2 family members have lost phones (one of which is sitting at the bottom of an ocean and is clearly unrecoverable), and phones are consumables that change every few years. I see there's some effort here on history sharing. Does that effort allow recovery of a chat history after an unrecoverable death of a primary phone? That's (honestly) the only usability thing I care about when it comes to E2EE.
  • klausa 3y ago
    https://engineering.fb.com/wp-content/uploads/2023/12/TheLabyrinthEncryptedMessageStorageProtocol_12-6-2023.pdf https://engineering.fb.com/wp-content/uploads/2023/12/TheLab... Page 33 and 34.
  • sdeframond 3y ago
    I backup my (encrypted) Signal conversations and sync them to some computers with Syncthing. I think it covers the "phone is at the bottom of the ocean" case. To be fair I haven't done any disaster recovery yet, so it might not work that well...
    • laserbeam 3y ago
      That's not something you can ask of a casual user though. Not saying I'm one but I can already not recommend Signal to random friends and family that are not tech savy for reasons like this one.
      • sdeframond 3y ago
        Yep, that's the old convenience vs. privacy dilemma...
        • AniseAbyss 3y ago
          [dead]
    • 3y ago
• PGNote 3y ago
  [dead]
• Tutanota 3y ago
  Good for Meta and their user base! It's great to see Big Tech follow suit. We've been doing this for a decade already as only end-to-end encryption can truly protect data. Plus, it's going to help with fighting bills like the Online Safety Bill and Chat Control when huge corporations join us; so bottom line: great news!
  • Dah00n 3y ago
    What Big Tech really wants is metadata. Metadata and which images are sent isn't encrypted. So this is E2EE minus what Meta wants to see. If one cares about privacy, one cares about metadata. Access to metadata equals poor privacy and is fluff encryption at best.
    • Tutanota 3y ago
      Absolutely right, and for that reason most tech-savvy people will still not trust Meta with their data. But that they start encrypting end-to-end is a good thing, regardless.
  • cies 3y ago
    Possibly good for meta (if they were forced to do this by law, this means they did not want to do this them selves, which by definition makes it "not good for Meta"). Certainly not good for their user base, as (as many pointed out) it's not safe if the clients are all closed source. This promotes a false sense of security, which is worse than an understood lack of security.
    • Tutanota 3y ago
      Agreed, should have phrased this more carefully!
• shp0ngle 3y ago
  I don't understand how conceptually they can do e2ee history of chat. If any mobile phone that logs in can query and read the history, why cannot the server? What's the trick?
  • deleted 3y ago
    [deleted]
  • deleted 3y ago
    [deleted]
  • klausa 3y ago
    https://engineering.fb.com/wp-content/uploads/2023/12/TheLabyrinthEncryptedMessageStorageProtocol_12-6-2023.pdf https://engineering.fb.com/wp-content/uploads/2023/12/TheLab... Page 33 and 34.
    • shp0ngle 3y ago
      So practically it means just logging in to a different device is not enough to get history, you have another logging in mechanism for that? (recovery code)
• 1B05H1N 3y ago
  Can you still see the meta data (sender, receiver and timedate)?
• jacooper 3y ago
  > Typically, E2EE messaging services rely on local storage and encryption keys to secure encrypted messages. Messenger, however, has a long history of storing people’s messages for them so that they can access them whenever they need without having to store them locally. That’s why we’ve designed a server-based solution where encrypted messages can be stored on Meta’s servers while only being readable using encryption keys under the user’s control. I remember Telegrams founder saying they don't use E2EE because you can't store messages with full E2EE, which obviously BS because matrix does it, and now Facebook too. Now they say there is no "elegant" solution. https://telegram.org/faq#q-why-not-just-make-all-chats-39secret-39 https://telegram.org/faq#q-why-not-just-make-all-chats-39sec...
  • pcl 3y ago
    It’s also obviously BS since the end-to-end encrypted data in their secret chats passes through their server tier. They could simply save it! The fact that they go to such lengths to convince us that they are doing a favor with their insecure-by-default approach has always rubbed me the wrong way.
    • jacooper 3y ago
      But they don't store secret chats, meaning you can't restore them on other devices and that's their supposed problem with E2EE
      • pcl 3y ago
        Yeah -- they created a product offering that supports their weird worldview. It's perfectly legit to store end-to-end encrypted data in its encrypted form and then secure the key material in some manner not visible to the cloud service provider. The Telegram folks have tried their darndest to convince us that this isn't really an option, and so therefore they must go insecure-by-default, even though they also pitch themselves as a bastion of secure messaging. It's always rubbed me the wrong way, since their claims are so obviously false. Which makes me assume they either don't know their domain well enough to be trusted to do any end-to-end encryption properly, or they have some hidden agenda. Neither of those make me want to treat any part of the Telegram chat experience as secure.
• DeathArrow 3y ago
  If I'd want secure chat, I'd rather use Telegram. I will trust FB only if metadata is also encrypted, their code is audited by a trusted 3rd party organization, and they can prove they are running only the audited code in production. And even then I would have some doubts.
  • seanieb 3y ago
    Telegram conversations are not end to end encrypted. If you do opt to use their end to end encrypted chat feature it only works on a 1:1 basis, and uses a dodgy protocol. The owner of telegram , company and employees are based in some of the most un-democratic police states in the world, where you have no privacy rights. To call Telegram a secure or private messaging service is laughable.
    • DeathArrow 3y ago
      >The owner of telegram , company and employees are based in some of the most un-democratic police states in the world Maybe. I don't live in that country. If perfect secrecy isn't achievable, I rather not let domestic actors to peek at my data. >uses a dodgy protocol What do you mean by dodgy protocol?
• zx8080 3y ago
  With their proprietary client it does not matter how secure is a protocol. There's always a risk of bad update or total compromise. And of course ads need to be targeted.
  • aembleton 3y ago
    Same with WhatsApp and signal
    • I_am_tiberius 3y ago
      I thought Signal is open source?
      • nicce 3y ago
        Also their builds are fully reproducible on Android.
        • zaik 3y ago
          Is there a guide how one can check that the PlayStore version matches the source code?
          • nicce 3y ago
            Here is one: https://github.com/signalapp/Signal-Android/tree/main/reproducible-builds https://github.com/signalapp/Signal-Android/tree/main/reprod...
      • dontlaugh 3y ago
        US spooks can get Apple or Google to deliver altered apps to targets, if nothing else.
        • viktorcode 3y ago
          Source?
• peterburkimsher 3y ago
  Will Facebook continue to support mbasic for messaging? This is one of the things I fear will be dropped when end-to-end security is added.
• contrarian1234 3y ago
  "Why we’re bringing E2EE to Messenger ... “ Okay, can someone give a good guess as to what's the real reason to do this? Not like all the feel-good BS - what's the business case? How is this gunna make them money? It seems this just makes them lose access to a ton of data to mine for advertisement. I chat with a friend on IG about something and I immediately get ads for it. It's a bit creepy, but I feel it's working the way they'd want it to (never bring up watches, you will get watch ads for the next 6 months) Are they bleeding a lot of user to Signal/Telegram b/c they lack encryption? (my impression is only nerds care about encryption) Are they getting harassed by requests from law enforcement? Are they in hot water b/c of child porn? Do they need plausible deniability? I don't really get why they're rolling this out. Like what's their angle. Seems like something users don't care too much about and they lose a ton of valuable data
  • whatever1 3y ago
    Half of their customers might end up in jail with the latest Supreme Court ruling on abortion. Nearly 1/4 of women have done abortion in their lifetime. And there are also co conspirators like husbands, Uber drivers, nurses and doctors.
    • sevg 3y ago
      > Half of their customers I have no side to take in this discussion, but just wanted to point out that the USA is not the only country that exists. I know it sometimes seems that way on Hacker News, but I promise you that there is a big wide world out there that has nothing to do with the Supreme Court :)
      • dewey 3y ago
        The topic is about a large US tech company though.
        • dc3k 3y ago
          The post they're replying to says "half of their customers", which implies 100% of their customers are in America, which is obviously completely wrong.
• ngrilly 3y ago
  WhatsApp is end-to-end encrypted, but all messages have to be stored locally, which is a problem on cheap smartphones. Telegram can work on a cheap smartphone by storing most messages server-side, but it's not end-to-end encrypted by default. Would be great to get the best of both worlds with Messenger, and see the other messaging apps follow suit.
  • FirmwareBurner 3y ago
    >but all messages have to be stored locally, which is a problem on cheap smartphones Why is that a problem for cheap phones?
    • ngrilly 3y ago
      Because if you send and/or receive a lot messages with large attachments (pictures and videos), then it will eat up a lot of storage on our your storage (can be gigabytes), and if you use a smartphone with only 64 GB of storage, it can quickly become an issue, and then you have to decide what to delete.
      • FirmwareBurner 3y ago
        That's a non issue for most cheap phones form the last few years, even sub 200 Euro phones, as most ship with at least 128GB as base storage. My OnePlus 3T came with 128 GB of base storage. In 2016! 7 years ago. Hell, on Amazon right now I can find a brand new 99 Euro 'Chinese Brand' Android phone with 128GB of storage and 8GB of RAM. Granted, I wouldn't recommend anyone actually go and buy that one, but it shows even if you're tight on cash and need a phone with lots of storage you can get it even on rock bottom prices. Only Apple is the one left who shortchanges you in 2023 wiht 64GB base storage even at +500 Euro phones, but that's an Apple-only problem, not a smartphone problem. Still, I'd much rather pay a bit extra for more storage on a phone to keep my encrypted messages locally than in the cloud of some shady app like Telegram that's "FREE" and yet needs to finance it's massive cloud bills somehow.
        • 3y ago
• bArray 3y ago
  > 1. Only the sender and recipients of an E2EE message can see its contents. > 2. Nobody (not even Meta) should be able to forge messages to appear to have been sent from someone they weren’t. From a business perspective, it makes perfect sense. Users want security and Meta don't want to be responsible for the data communicated. One question I have is how Meta will comply with UK law on E2E [1]: > Meta has been a leading industry player in the fight to tackle child sexual abuse. For over a decade, Meta has utilised hash matching technologies to enable it to detect child sexual abuse material being shared on its platforms. This has made it one of the leaders in detecting and reporting online child sexual abuse, providing law enforcement with leads to safeguard children and arrest child sex offenders. > However, Meta and other companies are now planning to implement E2EE, without similar technologies in place, across their messaging platforms such as Facebook Messenger and Instagram Direct Messages. The roll out of E2EE is likely to happen later this year. The National Center for Missing and Exploited Children (NCMEC) estimate up to 70% of Meta referrals could be lost following the roll-out of end-to-end encryption. Firstly, I would like to know what the UK government does with all of these referrals. Given the current state of UK policing, I predict it's almost nothing. Local government was itself complicit in child exploitation [2]. It appears this E2E implementation may have some form of backdoor anyway [1]: > The Safety Tech Challenge Fund is a UK government funded challenge programme that first ran from 2021 to 2022. The fund was designed to support the development of proof-of-concept tools to detect child sexual abuse material across E2EE environments, whilst upholding user privacy. The fund demonstrated that it would be technically feasible. > It is recognised though that each and every online social media platform and service is different, and therefore solutions will need to be tailored. Therefore, companies such as Meta should utilise their vast expertise and engineering resources and build on the outputs of this fund and develop solutions for their individual platforms/services. > In addition, some of the UK’s leading cryptographers have written an academic paper outlining a variety of techniques that could be used as part of any potential solution in E2EE to provide both user privacy and security, while protecting child safety and enabling law enforcement action. "The fund demonstrated that it would be technically feasible" - you can't leak information from a message without leaking information. The same method used to detect harmful content could also reveal information about the messages. For example, if an E2E message was delivered with hashes of images inside the message, it could also be used to detect political decent memes. [1] https://www.gov.uk/government/publications/end-to-end-encryption-and-child-safety/end-to-end-encryption-and-child-safety https://www.gov.uk/government/publications/end-to-end-encryp... [2] https://en.wikipedia.org/wiki/Rotherham_child_sexual_exploitation_scandal https://en.wikipedia.org/wiki/Rotherham_child_sexual_exploit...
• znpy 3y ago
  I had end-to-end security on the Facebook messensger about ten years ago when I was able to connect with Pidgin (iirc) and use the OTR plugin. That end-to-end security also didn't rely on Facebook. Not sure how this could work nowadays, I have closed my facebook profile many years ago.
• unobatbayar 3y ago
  > Our aim is to ensure that everyone’s personal messages on Messenger can only be accessed by the sender and the intended recipients Don't forget the authorities in the mass surveillance industry.
• deleted 3y ago
  [deleted]
• nalekberov 3y ago
  I don’t know how Meta will benefit from this (perhaps they are protecting themselves from upcoming regulations in EU). Important question is who is owning the key, if they own the key, that means nothing in terms of protection against their usage. Even if they don’t have the key, they don’t even care about messages itself anymore 1. It’s risky business, regulations might hit you hard 2. Metadata is good enough for them 3. They own the client, so they know how to extract more than useful data in the end. E2EE is important marketing trick nowadays, most users see it as if this makes them completely anonymous to companies like Meta. After all ads are their only source of generating money. They will do whatever it takes to satisfy advertisers, not the users.
• supermatt 3y ago
  So the client basically transmits the messages twice - once to relay to recipients via e2ee a la signal which specifically prevents the decryption of historical messages (forward secrecy), and the other to the storage backend using a different e2ee approach which allows the recovery of history (labyrinth via epoch segmentation and back-chaining of secrets).
• kangaroozach 3y ago
  But the Meta data still shows who is communicating with each other right?
• msavara 3y ago
  Dear Facebook. Still. I dont trust you.
• dbrgn 3y ago
  I assume users must still be able to send messages from different devices, just by entering their login data into a new Messenger client. According to their paper, they are doing client fan-out: "Messenger uses this "client-fanout" approach for transmitting messages to multiple devices, where the Messenger client transmits a single message `N` number of times to `N` number of different devices. Each message is individually encrypted using the established pairwise encryption session with each device." This means, the system is only as secure as its client registration protocol. They don't write a lot about it: "At registration time, a Messenger client transmits its public Identity Key, public Signed Pre Key (with its signature), and a batch of public One-Time Pre Keys to the server. The Messenger server stores these public keys associated with the user's device specific identifier. This facilitates offline session establishment between two devices when one device is offline." If I interpret this correctly, the server can, at any time it desires, silently add new clients. Those devices will receive all messages directed at that user, and will be able to decrypt it. I guess that's in line with their bla-bla about setting user expectations: "Our focus is on determining the appropriate boundaries, ensuring that we remain true to our commitments, setting the correct user expectations, and avoiding creating meaningful privacy risks, while still ensuring that the product retains its usefulness to our users." Don't forget, their commitments are making profit and exploiting user data.
  • yincrash 3y ago
    This sounds similar to what Apple's iMessage does as well. Ultimately, if the user cannot check which devices that their client is sending messages to, then yes, the central server can tell clients to establish a pair with a hostile device the central server controls.
• markstos 3y ago
  Because WhatsApp is their product they’ve messed up the least.
• jupenur 3y ago
  This is great. I feel like E2EE has slowly fallen out of focus in recent years as the tech has stabilized, but important developments like this and the MLS standardization still continue to happen. One specific area where I'd love to see more focus and attention is the web as a platform for E2EE applications. Currently, because of the inherent problems related to application delivery and trust relationships on the web, every step forward in E2EE adoption is a step away from webapps being first-class citizens -- even as PWAs keep becoming more viable for a wider range of use-cases otherwise. Even though an increasing number of companies maintain web implementations of their E2EE apps, these are always the fallback option when nothing "better" is available; the tech to make E2EE secure in webapps doesn't exist yet, but companies also have a unrelated incentives to push users to native apps. There are no serious efforts to remedy the situation and develop tech that would make it possible to deliver secure E2EE through the web. The post mentions a couple of relevant goals: > 3. Control over endpoints > 8. Third-party scrutiny They also mention the Code Verify extension[1], which may seem like a solution, but does not stand up to scrutiny: It only notifies the user of unexpected changes in the app, but does not prevent them. The detection logic it implements also seems trivially bypassable, and in more ways than one. Even if it was sufficiently enforcing application integrity, an extension like Code Verify is unlikely to ever become widely-adopted enough to make a dent. And of course it's not even available in all browsers on all host platforms. There are also other similar extensions that suffer from similar shortcomings. Browser vendors could solve the problem by providing APIs that allow the kind of integrity enforcement needed, akin to SRI[2], but that would mean you first have to agree on a standard and then implement it consistently everywhere and then webapps could slowly start adopting it. And because of past failures like HPKP[3], browser vendors would probably be hesitant to even start considering anything like it. I believe a solution is possible using only the currently available web APIs, however, and for the past few months I've been prototyping something that's now at a stage where I can call it functional. The general idea is that using service worker APIs and a little bit of cryptography, a server and a client application can mutually agree to harden the application instance in a way that the server can no longer push new updates to it. After that, the client application can be inspected manually with no risk of it changing unannounced, and new versions of the app can be delivered in a controlled way. While my prototype is nowhere near production-grade at this point, it's nearing a stage where I'll be able to publish it for public scrutiny and fully validate the concept. Until then I'll be implementing tests and examples, documenting the API and threat model, and smoothing out the rough parts of the code. If anyone's interested in collaborating on this or just hearing more details, feel free to reach out. I'd love some early feedback before going fully public. [1] https://engineering.fb.com/2022/03/10/security/code-verify/ https://engineering.fb.com/2022/03/10/security/code-verify/ [2] https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres... [3] https://developer.mozilla.org/en-US/docs/Glossary/HPKP https://developer.mozilla.org/en-US/docs/Glossary/HPKP
• dodke 3y ago
  My account
• methuselah_in 3y ago
  Facebook and privacy are two opposite poles!
• dom96 3y ago
  I wish they didn't do this. They already have an end-to-end encrypted messaging application: it's called WhatsApp. I have seen so many people (and have myself been) bitten by WhatsApp's E2E implementation: messages lost because your phone was barely online and you "read" the message but didn't fully receive it, leaving you to awkwardly ask people to re-send things. Plus the constant need to backup your messages because if you don't you can lose access to them forever. Plenty of my family have lost messages/images that were sent to them and were important to them. I'd rather not deal with this. Sometimes I want all my messages to be stored on a big company's servers. They should at least give people the option to choose.
  • rob 3y ago
    > They should at least give people the option to choose. Messenger does. You can have a normal chat and a private, end-to-end encrypted chat at the same time with the same person, both completely separate.
  • Miraltar 3y ago
    > We are beginning to upgrade people’s personal conversations on Messenger to use end-to-end encryption (E2EE) by default The first line of the article suggests that it's an option
  • cubefox 3y ago
    Apparently in FB Messenger, conversations will still be stored in the cloud, albeit encrypted: > Messenger has always allowed clients to operate off of a small stored local cache, relying on a server-side database for their message history. Neither WhatsApp nor Secret Conversations operated in this manner, and we didn’t want all users to have to rely on a device-side storage system. Instead, we designed an entirely new encrypted storage system called Labyrinth, with ciphertexts uploaded to our servers and loaded on-demand by clients, while operating in a multi-device manner and supporting key rotation when clients are removed.
  • joshspankit 3y ago
    Sometimes I feel like these are the “plastic-free bag” solution[0] designed to make the market embrace the “tried and true” old way. [0] There was this chip bag from a major chip manufacturer and it proudly claimed the bag was plastic free (might even have been compostable), but it was the thinnest, loudest, crinkliest bag you’d ever heard. It seemed like the chip manufacturer board meeting went like this: “The people want us to cut out plastic! For the environment or something. Don’t they know how much easier and more profitable plastic bags are?? You know what? If they want plastic-free we’ll give them plastic-free... We’ll make them regret even asking...” That bag didn’t last long before it vanished never to be seen again.
• gmerc 3y ago
  By now we know none of this means anything if a notification is triggered with the message content.
  • xiphias2 3y ago
    It's strange that your comment is not on the top. I looked at the whitepaper and they didn't even mention it. The reason e2e encryption got enabled is to make people feel safe.
  • dannyw 3y ago
    That's not true. Both iOS and Android support sending encrypted notifications that are decrypted on-device. How do you think Signal notifications work?
    • contact9879 3y ago
      Note that Signal only uses push notifications to wake the app up. Then it directly connects to the Signal service to receive messages.
    • gmerc 3y ago
      We are talking about whatsapp, no?
• 1oooqooq 3y ago
  this have to do with industry wide push to RCS over SMS, to help with 3rd party doctrine. And in FB case to unify US (messenger) with rest of the world (whatsapp) audiences.
• beders 3y ago
  The input field is not E2EE, the text rendering is not E2EE. Plenty of opportunity to look at your fine messages in plain text. Impressive theater though.
• user3939382 3y ago
  There is literally no security standard, papers, or explanations that Facebook could offer that would compel me to trust anything they say or make. It may as well be a messenger app branded by the CIA telling me about its new privacy features.
• skywhopper 3y ago
  What's interesting to me is that they never quite explicitly claim that they (Meta) can't access the contents of the "E2EE" messages. All the weasely language they use around this makes me think that they in fact can do so.
• devaiops9001 3y ago
  This is HORSE SHIT, and I will tell you why: Was source code released? Can I build Facebook messenger with private cicd running on my own silicon? If not, there is no encryption worth a damn. You have to be very very stupid to believe otherwise. What Facebook is doing here is deploying a massive honeypot.
• zelphirkalt 3y ago
  How annoyed I am by these attempts to name-squat a whole category of technology (or other things) ... "Messenger". How idiotic on one hand and how insidious on the other hand that naming is. Just like MS "Teams".
• macilacilove 3y ago
  Regular people talk illegal things on messenger all the time, and if law enforcement gets addicted to sweet data requests, users will flee to wherever. E2E messaging is a better product. Offering it free (at a loss) makes it hard to beat. What's more, some major govts may be prompted to ban E2E, so they keep their data and kill Signal and others, while they are the 'good guys'. FB can probably create a 99% accurate ad profile on you with just metadata, likes and tracking you on the web. If not they can push local profiling models on your phone. With all that said, I still think it is a genuinely good thing for humanity as it is now, and I am cautiously optimistic.
• deafpolygon 3y ago
  can FB be trusted? Is there a catch?
• teling 3y ago
  How can a user like me actually verify this is the case? All we see before and after are encrypted byte streams? Do we have access to our key pair?