10 ms·
"Why we’re bringing E2EE to Messenger ... “ Okay, can someone give a good guess as to what's the real reason to do this? Not like all the feel-good BS - what'
by contrarian1234 3y ago
"Why we’re bringing E2EE to Messenger
...
“
Okay, can someone give a good guess as to what's the real reason to do this? Not like all the feel-good BS - what's the business case? How is this gunna make them money?
It seems this just makes them lose access to a ton of data to mine for advertisement. I chat with a friend on IG about something and I immediately get ads for it. It's a bit creepy, but I feel it's working the way they'd want it to (never bring up watches, you will get watch ads for the next 6 months)
Are they bleeding a lot of user to Signal/Telegram b/c they lack encryption? (my impression is only nerds care about encryption)
Are they getting harassed by requests from law enforcement?
Are they in hot water b/c of child porn?
Do they need plausible deniability?
I don't really get why they're rolling this out. Like what's their angle. Seems like something users don't care too much about and they lose a ton of valuable data
- whatever1 3y agoHalf of their customers might end up in jail with the latest Supreme Court ruling on abortion. Nearly 1/4 of women have done abortion in their lifetime. And there are also co conspirators like husbands, Uber drivers, nurses and doctors.
- sevg 3y ago> Half of their customers I have no side to take in this discussion, but just wanted to point out that the USA is not the only country that exists. I know it sometimes seems that way on Hacker News, but I promise you that there is a big wide world out there that has nothing to do with the Supreme Court :)
- dewey 3y agoThe topic is about a large US tech company though.
- dc3k 3y agoThe post they're replying to says "half of their customers", which implies 100% of their customers are in America, which is obviously completely wrong.
- xigoi 3y agoIt also seems to assume that all women in the USA have had an abortion???
- sevg 3y agoThe USA makes up only about 8-10% (250M) of total Facebook users (3B) based on a quick search I just did. They're not even the largest user base by country, which is apparently India.
- aembleton 3y agoBut they are the most valuable cohort in terms of revenue https://www.statista.com/statistics/251328/facebooks-average-revenue-per-user-by-region/ https://www.statista.com/statistics/251328/facebooks-average...
- EZ-E 3y agoHow the hell does Facebook generate 56$ of revenue per US user per quarter? Are selling ads and selling personal information really that lucrative?
- filleokus 3y agoWhat is the share of revenue from US? I would guess it's not thaaat far from 50%. The median income in the US is like 20x of India, so presumably ad views from the US ought to be quite a lot more valuable. I would guess EU + US is the vast majority of revenue.
- michpoch 3y agoThat doesn't matter if we're talking about % of users that could be affected by some local-US law.
- deleted 3y ago[deleted]
- xcdzvyn 3y agoIf their entire user base is American, and exactly half are women, and every single one of those women have had an abortion in the last year, and they all live in states where it's illegal, yeah, half of their customers might end up in jail.
- hsbauauvhabzb 3y agoWhat’s the total cost of encryption engineering / bau? I assume the ‘Facebook cares about my privacy’ goodwill from unknowing users will be worth more, but building a ‘secure’ public reputation has to start somewhere.
- isodev 3y agoSince they control the client, is it possible that the "ad profiling" can still take place on the client, after the message is received and decrypted for visualisation? The E2EE only means the message is not readable "in transit" (as in after it leaves a Facebook client)
- knallfrosch 3y ago1. Meta can read the metadata perfectly well (who communicates with whom and when), which is enough for ads. 2. Meta doesn't want to be able to read messages, since it's a PR nightmare when doing so. Case: Ordered to do so by a government agency. People could switch to Signal. 3. Data isn't readable "in transit", since it's encrypted with HTTPS. Only Facebook servers could read it if they wanted.
- contravariant 3y agoAs long as they control the client any kind of government order is still a problem for them. However it does make it a bit more difficult for them to spy on a conversation, which is arguably a good thing.
- 0xFF0123 3y agoWhat use is the metadata for ads?
- this_is_not_you 3y agoTop of my head: * Who are you messaging most (best friends, family). If they like stuff, you might like the same stuff. * When are you messaging people (awake time > profiling) * Messaging companies (obvious, what are you into)
- theshrike79 3y agoAlso: Where are you messaging You clicked an ad about Product X, you're messaging your friend B from a store that sells Product X -> Serve ads about Product X to B.
- planb 3y agoEncryption is a great argument against messenger-interop regulations like the EU is planning. https://www.eff.org/de/deeplinks/2022/04/eu-digital-markets-acts-interoperability-rule-addresses-important-need-raises https://www.eff.org/de/deeplinks/2022/04/eu-digital-markets-...
- ddalex 3y agoWhy would it? Diffie-Hellman key exchange is a thing.
- ollybee 3y agoAn argument, not a valid argument.
- theshrike79 3y ago"How can we be sure a 3rd party implements the encryption properly" is the counter-argument. How would you refute that? Trust users to check that some code is the same on both devices? What would prevent a bad actor from MITMing the whole thing from the start?
- lukevp 3y agoHmm, but it’s OK to trust that web browsers implement TLS properly? And your router isn’t MITMing you? Or your SSH app exfiltrating all your server information? Why is this different?
- blackoil 3y ago> And your router isn’t MITMing you Can it do so if the encryption and key management is at the client? > Or your SSH app exfiltrating all your server information That's a small niche, and most service don't expose SSH to public. > OK to trust that web browsers implement TLS properly hmm, you may have a point, maybe they'll ensure that only whitelisted browsers can access it, like Chrome with DRM for HTML. Only purpose is public safety. /s
- 3y ago
- camillomiller 3y agoThey need to show the regulators they're doing something about the absurd level of data mongering they do as their quintessential business model.
- shmichael 3y agoFuture interoperability with WhatsApp.
- LTom 3y agoYes, that was explicitly stated in an interview[1] a while back. Quoting from the specific section: > “Okay, well, WhatsApp — we have this very strong commitment to encryption. So if we’re going to interop, then we’re either going to make the others encrypted, or we’re going to have to decrypt WhatsApp.” And it’s like, “Alright, we’re not going to decrypt WhatsApp, so we’re going to go down the path of encrypting everything else,” which we’re making good progress on. But that basically has just meant completely rewriting Messenger and Instagram direct from scratch. 1: https://www.theverge.com/23889057/mark-zuckerberg-meta-ai-elon-musk-threads-quest-interview-decoder https://www.theverge.com/23889057/mark-zuckerberg-meta-ai-el...
- PrimeMcFly 3y ago> How is this gunna make them money? It's about them not losing customers to the competition that does offer E2EE
- viktorcode 3y agoAll large competing messengers have P2P encryption. Today it is what the customers expect, and if they are to stay competitive Meta must roll it out.
- nindalf 3y ago“What self interested, selfish reason do these terrible people have to this ostensibly good thing?” - paraphrasing your question. Answer - Message content wasn’t used for advertising. I believe it had been tried at some point and found to be sort of useless. But people like you won’t believe that, so end to end encryption might help build trust and increase engagement.
- akomtu 3y agoe2e encryption can be negotiation chip with gov agencies: "we turn off encryption this time, but you'll forget about our shady ads business"
- nindalf 3y agoFirstly E2E can’t be turned off on a dime. WhatsApp e2e has never been turned off since it was turned on. Secondly, please educate yourself about what the government actually thinks about the ad business you’ve described as “shady”. Even if it was “shady” to show ads based on preferences and never reveal or sell those preferences to a third party … the elected representatives in government really like having social media ads as an option in elections. Here, read this so you can learn how government actually influences social media to do their bidding - https://knightcolumbia.org/blog/jawboned https://knightcolumbia.org/blog/jawboned > The senator’s office told Katie that they really wanted to ban that practice but knew they would never get it through the Senate since so many campaigns relied on the tools for their elections. So instead, they said they were going to pressure tech companies like ours to ban the use of the tool in the hopes that if one of us did so, the others would as well. Although we did not stop using Custom Audiences entirely, Facebook and other platforms did dramatically reduce the targeting options for political advertisers.
- kyboren 3y ago> show ads based on preferences and never reveal or sell those preferences to a third party That's not how modern ad markets work. Those preferences are indeed revealed to third parties, specifically ad exchanges and DSPs, as part of the bidstream data. Now, you say, those bidstream data contain no PII! Except that de-anonymizing those data is absolutely key to targeting, and is widely practiced. Recently in the news: "Patternz", an Israeli spy-tech company, for years hoovered up and stored all the bidstream data across 87 ad exchanges and SSPs including Google, Yahoo, MoPub, AdColony, and OpenX, de-anonymized them, and claims to have profiles on billions of users including their location history, home address, interests, information about 'people nearby', 'co-workers' and 'family members'. (See also: https://pbs.twimg.com/media/F-5bA6QW8AAyfSK.jpg https://pbs.twimg.com/media/F-5bA6QW8AAyfSK.jpg ) Please stop spreading dangerous misinformation about the threat programmatic advertising poses to our privacy and national security. Your extremely sensitive data are being passed around willy-nilly and this will not change until RTB is outlawed.
- nicman23 3y ago"we cannot give access to the user's messages as we do not have them"
- viddi 3y agoGiven that E2EE messengers usually require being run on a smartphone as primary device, my guess is that they are trying to push the last remaining non-app-and-web-only users to their messenger app. I'm one of them and I don't like this.
- asah 3y ago??? FB Messenger is available on facebook.com ?
- dspillett 3y agoIn a way that works well on low power mobile devices? Most people I know using FB messenger do so on desktop via facebook.com and the app on mobile. I don't see them removing the former any time soon but if the web only version still exists for mobile users perhaps that will go.
- viddi 3y agoYes, and my guess is that they are planning on removing the standalone messenger from the web version. You'll probably need to have the FB Messenger app installed on a smartphone device in order to use E2EE. That would make it impossible to write messages on the web version (i.e. facebook.com) without having an app installed. I currently do not have the app installed and am able to write messages on the pure web version of FB on desktop. My guess is that they are enabling E2EE to get the last remaining desktop-only-and-website-only messenger users to install the app. Hope that cleared it up.
- 3836293648 3y agoSoon it will be illegal to offer non encrypted chats not scanned for child porn. So either encrypt or start scanning (EU)
- _u2yk 3y agoThis makes the most sense to me.
- phi0 3y agoYlva Johansson, the EU commissioner who proposed that (apparently failing [1]) law, has used Meta’s model behaviour in reporting CSAM material to NCMEC & EU authorities as the justification for why that law should exist. Considering it was Meta’s policy to scan even when not mandated, it seems like an internal shift in attitude. [1] https://fortune.com/europe/2023/10/26/eu-chat-control-csam-encryption-privacy-european-commission-parliament-johansson-breyer-zarzalejos-ernst/ https://fortune.com/europe/2023/10/26/eu-chat-control-csam-e...
- dancemethis 3y agoI mean, it's a proprietary platform. It can't even be guaranteed the data isn't tampered with - same case as Whatsapp. It's a PR move to _say_ they did it.
- crossroadsguy 3y agoWell, it’s encrypted in transit, maybe encrypted in their storage on their backend. But when the text, after being decrypted, appears in their textviews and websites I don’t think it is not kosher for them to tag every single word and glean lots of data/metadata from there and send home do their magic without associating with the identity. I thought that is something that is given. They also have not touched upon it. Except maybe the “Logging limitations” part - that section read like hogwash to me. A kind of fatigue is setting in when it comes to Fb messenger and Instagram. They have already bloated these apps and they can’t really add any other gimmicks. So they are trying the “other” gimmick now. My take is or guess is - they are doing it because they really have nothing else to do.
- holmesworcester 3y agoMaybe they're doing it because it's the right thing to do, and because they'd like people to trust them. Also: https://techcrunch.com/2023/07/11/teen-and-mom-plead-guilty-to-abortion-charges-based-on-facebook-data/ https://techcrunch.com/2023/07/11/teen-and-mom-plead-guilty-... They must be able to do good targeted advertising without message contents, with public likes and other data on scrolling behavior, especially as AI tools improve. Maybe having this data is more trouble than it's worth. Data is a liability as well as an asset.
- gmadsen 3y agoits the "right" thing to do only by a small population of tech workers. Most people do not care, and ad customers would be very upset if this degrades targeting.
- pnt12 3y agoI contest both opinions: 1. More and more people care about this, eg journalists, politicians, etc. Apple has been talking about this a lot, although some being propaganda for messages, but their customers are already somewhat aware of private messenging. 2. It may not degrade ad targeting that much. I imagine doomscrolling does it way more: you engaged with this post, you ignored that one, and so on.
- gmadsen 3y agofor 2, I will say anecdotally I have never in my life bought something directly from an ad until the last 2 years on instagram. It actually found things directly useful to me that I did not know about beforehand (I did still go through an hour of research or so, but was amazed at the algorithm discovery capability)
- cqqxo4zV46cp 3y agoOP’s question rejects the premise of your justification. Facebook doesn’t have much of a track record of “doing the right thing” for its users.
- 3y ago
- alwayslikethis 3y agoComplying with warrants and other requests has a cost. By claiming not to have access to them, they can save money. I think they or some other advertisers have used the actual messages before, but concluded it was too noisy to be worth it.
- grey-area 3y agoSurely they could still mine the data you send and receive, because their app decrypts it for you and displays it for you. So they could still be sending their server data like ‘likes watches’ without technically breaking the encryption.
- gmerc 3y agoGiven the timing this was decided it the answer was “if we can’t see it it can’t cause a scandal for us and can’t be regulated”
- BirAdam 3y agoMy guess is deniability, just like Apple. Apple wanted to make CSAM detection work and make iPhone essentially a weapon law, but when their users hit back, they just made iCloud e2ee. With the number of child predators on FB, I am guessing that Meta wants to wash their hands of responsibility.
- zelphirkalt 3y agoWin more users and therefore more metadata by buzzwording.
- xinayder 3y agoThey can easily identify what and who you're talking to with message metadata, which is usually not encrypted. They can cooperate with government agencies this way. You don't need to know the exact content of a message, you just need to know who you're talking to and when.