4 ms·

Not only is this huge by itself (600 million users with E2E encrypted messages by default), but I'm hoping this will put a big pressure on Google, Microsoft and

Not only is this huge by itself (600 million users with E2E encrypted messages by default), but I'm hoping this will put a big pressure on Google, Microsoft and others to adopt TextSecure's protocol (or something very similar), too. This is how you deliver strong security to the masses. Not by convincing all your friends to adopt some weird and obscure chat app with the only benefit that it's "more secure" (most won't care), but by getting large service providers to adopt it and push it to hundreds of million of users without them even noticing. Oh, and I assume that if Whatsapp adopted it, Facebook Chat isn't too far behind...right?

rsync 12y ago
"This is how you deliver strong security to the masses." You cannot deliver strong security on a mobile phone platform. The carrier owns you. In fact, the carrier owns you doubly over because it can control "your" computer via two pathways - with the baseband and the SIM card - both of which you have no control over. You cannot be secure on a device that a third party can interact with at the level of DMA. Further, while I keep adding a caveat about some phones whose SOC involves a baseband that is more akin to a USB modem, in terms of architecture, it turns out that even these "less terrible" SOC designs still have kind-of-sort-of ways to attain full control by the baseband over the AP. It really is that bad. You gain no protection from the carrier or a state actor that can influence the carrier, and certainly no protection from a rogue cellsite that can instruct your baseband (or your SIM) to manipulate main memory arbitrarily.
alexjarvis 12y ago
Highly unlikely seeing as Facebook uses the content of your messages to market ads to you, build up a profile of you, identify you and identify trends (links, keywords). The fact that Facebook owns WhatsApp makes this announcement a big surprise as I think they profit far more with unencrypted messages (although WhatsApp was just delivering, not storing them supposedly).
- mike_hearn 12y ago
  I have never seen an ad on Facebook that was obviously targeted based on my chats, in fact, targeting ads based on my chats would be a pointless, money-losing approach for them as I never talk about commercially relevant things with my friends. The ads I see on Facebook currently are for SSL certificates (guess what I bought recently), BGP routing optimisation products (not sure why), and TransferWise (I used them once). In short, lots of remarketing and something presumably targeted at one of the news sources I get in my feed e.g. slashdot. These are all pretty nerdy yet also pretty reasonable ads. Ads targeted based on my chats would mostly revolve around .... well, not sure. At best, nights out or local cinemas. I doubt there's much profit in that.
  - alexjarvis 12y ago
    It's possible to build a more complete picture of someone's interests based on what they share privately via Facebook chat. It's also public knowledge that they've been parsing messages for links to then 'like' the appropriate pages inside Facebook. Rather than debate about how much profit there could be in it, which is entirely down to what the user talks about, I think it is important to realise the potential here even if it not fully realised at this point it time. Also remember that they are keeping chat history indefinitely in HBase clusters (because they are 'sentimental') so as your habits and interests change over time this will become invaluable data to marketers who want to understand consumer behaviour. I think it's great that WhatsApp are implementing end-to-end encryption but their now immediate connection with Facebook doesn't sit well with me. Perhaps I'm an idiot, but it doesn't take long to realise that there are perhaps competing interests at play here.
- ianburrell 12y ago
  The main reason why you won't see end-to-end encryption for Facebook is that the messages are also available through the Facebook web site in addition to Facebook Messenger app. Which means that the Facebook servers need to store the key to display the messages.
  - alexjarvis 12y ago
    If you use a different key to encode the message for each client (web or app) then this is not necessary. This is how iMessage works.

rsync 12y ago

"This is how you deliver strong security to the masses." You cannot deliver strong security on a mobile phone platform. The carrier owns you. In fact, the carrier owns you doubly over because it can control "your" computer via two pathways - with the baseband and the SIM card - both of which you have no control over. You cannot be secure on a device that a third party can interact with at the level of DMA. Further, while I keep adding a caveat about some phones whose SOC involves a baseband that is more akin to a USB modem, in terms of architecture, it turns out that even these "less terrible" SOC designs still have kind-of-sort-of ways to attain full control by the baseband over the AP. It really is that bad. You gain no protection from the carrier or a state actor that can influence the carrier, and certainly no protection from a rogue cellsite that can instruct your baseband (or your SIM) to manipulate main memory arbitrarily.

alexjarvis 12y ago

Highly unlikely seeing as Facebook uses the content of your messages to market ads to you, build up a profile of you, identify you and identify trends (links, keywords). The fact that Facebook owns WhatsApp makes this announcement a big surprise as I think they profit far more with unencrypted messages (although WhatsApp was just delivering, not storing them supposedly).

mike_hearn 12y ago
I have never seen an ad on Facebook that was obviously targeted based on my chats, in fact, targeting ads based on my chats would be a pointless, money-losing approach for them as I never talk about commercially relevant things with my friends. The ads I see on Facebook currently are for SSL certificates (guess what I bought recently), BGP routing optimisation products (not sure why), and TransferWise (I used them once). In short, lots of remarketing and something presumably targeted at one of the news sources I get in my feed e.g. slashdot. These are all pretty nerdy yet also pretty reasonable ads. Ads targeted based on my chats would mostly revolve around .... well, not sure. At best, nights out or local cinemas. I doubt there's much profit in that.
- alexjarvis 12y ago
  It's possible to build a more complete picture of someone's interests based on what they share privately via Facebook chat. It's also public knowledge that they've been parsing messages for links to then 'like' the appropriate pages inside Facebook. Rather than debate about how much profit there could be in it, which is entirely down to what the user talks about, I think it is important to realise the potential here even if it not fully realised at this point it time. Also remember that they are keeping chat history indefinitely in HBase clusters (because they are 'sentimental') so as your habits and interests change over time this will become invaluable data to marketers who want to understand consumer behaviour. I think it's great that WhatsApp are implementing end-to-end encryption but their now immediate connection with Facebook doesn't sit well with me. Perhaps I'm an idiot, but it doesn't take long to realise that there are perhaps competing interests at play here.
ianburrell 12y ago
The main reason why you won't see end-to-end encryption for Facebook is that the messages are also available through the Facebook web site in addition to Facebook Messenger app. Which means that the Facebook servers need to store the key to display the messages.
- alexjarvis 12y ago
  If you use a different key to encode the message for each client (web or app) then this is not necessary. This is how iMessage works.