5 ms·

This sounds like it's more about keeping Facebook data out of Google's hands. They must leak a lot of information about who did what on Facebook to them through

This sounds like it's more about keeping Facebook data out of Google's hands. They must leak a lot of information about who did what on Facebook to them through notifications ending up in Gmail accounts? Does that impact either party in a significant way? Just a thought.

icebraining 11y ago
The number of people who will actually upload their PGP key is so low that the loss for Google is negligible, and FB knows it. I find it more likely that they want to protect and to be seen to protect their users.
- cinquemb 11y ago
  The number of people who will actually upload their PGP key is so low… So another act in "security" theater for most people. They must keep everyone guessing at what they will do next.
  - mynameisvlad 11y ago
    Wat. How is this security theater? It's providing an actual, useful service for those who choose to use it. If the majority of people choose not to, then the fault would lie primarily on the end user, not on Facebook.
    - mike_hearn 11y ago
      Indeed. It's not theater - this really is more secure than before. It's just got painful usability. However that is not Facebook's fault: the security community has failed to produce any end-to-end encrypted email product that is easy to use. The good news is: a) This continues the momentum that the big Valley companies are creating around strong crypto b) This will motivate people to build better replacements for PGP, because now they know that they might actually receive encrypted emails if they can get sweis and others at Facebook on board. S/MIME would have been slightly better, IMO, but I understand why they didn't do it that way - Yahoo and Google are working on OpenPGP browser extensions, and "copy/paste your key" is easier than "upload your certificate". We badly need a modern, fresh take on email end-to-end crypto.
    - cinquemb 11y ago
      If people trust other mail providers, which most do in general, why would they use this? Maybe facebook has some numbers on how many users distrust other major mail providers to the extent to use this, while also trusting facebook. At least to me, that sounds ridiculous. Because along the measures of distrustfulness of who allows information to propagate to third parties (some third parties more privileged than others…), I don't particularly see any major mail provider above and beyond any other major players… Considering that most people wont even know what GPG/PGP are, this seems like an exercise in "Don't trust others, but trust me" and the user is supposed to go like "Welp, ok!"? Haha.
      - mynameisvlad 11y ago
        No, it's more an exercise in "Don't trust anyone else, trust this proven, well-known (in the tech world) encryption" which is markedly different than "Don't trust others, trust me". PGP doesn't give you confidence in the source, nor should it. It just gives you confidence on the transmission. Now if we could get the public more aware of it, then that'd be great. :) In any case, this isn't security theater. There's nothing theatrical about this. This is a real security benefit that has newly been added. Lots of things can be said about PGP in general, sure, but the ability to encrypt the messages from Facebook so that only you can read them is an actual security benefit. The entire concept of "security theater" is something that looks like it increases security but does nothing. By sheer fact that encrypting communications increases security, it can't be security theater.
        cinquemb 11y ago
        "…ability to encrypt the messages from Facebook so that only you can read them is an actual security benefit." Except it isn't really "only you", its whoever else has access to the key or keys facebook uses to encrypt such messages and if one distrusts other mail providers that they use to such degree, but trusts facebook, I'd really start question what threat model they are contriving…
        dragonwriter 11y ago

icebraining 11y ago

The number of people who will actually upload their PGP key is so low that the loss for Google is negligible, and FB knows it. I find it more likely that they want to protect and to be seen to protect their users.

cinquemb 11y ago
The number of people who will actually upload their PGP key is so low… So another act in "security" theater for most people. They must keep everyone guessing at what they will do next.
- mynameisvlad 11y ago
  Wat. How is this security theater? It's providing an actual, useful service for those who choose to use it. If the majority of people choose not to, then the fault would lie primarily on the end user, not on Facebook.
  - mike_hearn 11y ago
    Indeed. It's not theater - this really is more secure than before. It's just got painful usability. However that is not Facebook's fault: the security community has failed to produce any end-to-end encrypted email product that is easy to use. The good news is: a) This continues the momentum that the big Valley companies are creating around strong crypto b) This will motivate people to build better replacements for PGP, because now they know that they might actually receive encrypted emails if they can get sweis and others at Facebook on board. S/MIME would have been slightly better, IMO, but I understand why they didn't do it that way - Yahoo and Google are working on OpenPGP browser extensions, and "copy/paste your key" is easier than "upload your certificate". We badly need a modern, fresh take on email end-to-end crypto.
  - cinquemb 11y ago
    If people trust other mail providers, which most do in general, why would they use this? Maybe facebook has some numbers on how many users distrust other major mail providers to the extent to use this, while also trusting facebook. At least to me, that sounds ridiculous. Because along the measures of distrustfulness of who allows information to propagate to third parties (some third parties more privileged than others…), I don't particularly see any major mail provider above and beyond any other major players… Considering that most people wont even know what GPG/PGP are, this seems like an exercise in "Don't trust others, but trust me" and the user is supposed to go like "Welp, ok!"? Haha.
    - mynameisvlad 11y ago
      No, it's more an exercise in "Don't trust anyone else, trust this proven, well-known (in the tech world) encryption" which is markedly different than "Don't trust others, trust me". PGP doesn't give you confidence in the source, nor should it. It just gives you confidence on the transmission. Now if we could get the public more aware of it, then that'd be great. :) In any case, this isn't security theater. There's nothing theatrical about this. This is a real security benefit that has newly been added. Lots of things can be said about PGP in general, sure, but the ability to encrypt the messages from Facebook so that only you can read them is an actual security benefit. The entire concept of "security theater" is something that looks like it increases security but does nothing. By sheer fact that encrypting communications increases security, it can't be security theater.
      - cinquemb 11y ago
        "…ability to encrypt the messages from Facebook so that only you can read them is an actual security benefit." Except it isn't really "only you", its whoever else has access to the key or keys facebook uses to encrypt such messages and if one distrusts other mail providers that they use to such degree, but trusts facebook, I'd really start question what threat model they are contriving…
        dragonwriter 11y ago