8 ms·

If you read the article, it’s talking about not putting in a backdoor, and not Facebook saying “we have access to all encrypted messages, we’re just not giving

If you read the article, it’s talking about not putting in a backdoor, and not Facebook saying “we have access to all encrypted messages, we’re just not giving them to you”. As it stands, they’re end-to-end encrypted so not even Facebook can’t see your messages, and that’s what Barr doesn’t like

SilasX 7y ago
Why is everyone so confident Facebook hasn’t already backdoored it?
- bytematic 7y ago
  Not sure the fallout of the public finding out would be worth it over the value add of reading messages, maybe I'm wrong but that's how I would look at it.
- excalibur 7y ago
  They have in a manner of speaking. The communication channel is still encrypted, they just run their surveillance algorithms directly on your device. https://www.forbes.com/sites/kalevleetaru/2019/05/05/facebook-just-gave-repressive-regimes-the-ultimate-surveillance-blueprint/ https://www.forbes.com/sites/kalevleetaru/2019/05/05/faceboo...
  - throwaway824721 7y ago
    That Forbes article was wrong: https://news.ycombinator.com/item?id=20587643 https://news.ycombinator.com/item?id=20587643
    - driminicus 7y ago
      Facebook says in a hn post that the article is wrong, but I have no real reason to trust Facebook, given their track record.
      - mentat 7y ago
        > if we ever did it would be quite obvious and detectable that we had done it. It's running in your device, you don't have to trust them if you have technical skill.
        driminicus 7y ago
        I have little desire to decompile every update and/or constantly analyse what their app is doing. They've proven to be untrustworthy on multiple occasions, and haven't given me much reason to think they've changed. They might convince me if they open their client and server code, but even then they're yet another walled garden only interested in keeping their monopoly by building inferior products and using regularly capture to prevent any competition from doing the same thing they did to MySpace.
        bduerst 7y ago
        You can't read encrypted packages being sent by the app. The message telemetry could be bundled by the app with other telemetry and you wouldn't know despite your technical skill.
    - badrequest 7y ago
      only if you choose to believe Facebook it was
    - SilasX 7y ago
      I don't consider a self-serving assurance from a company representative to be conclusive proof.
- likpok 7y ago
  People regularly reverse engineer the Facebook apps to see what’s inside. (For example: Jane Wong)
- nighthawk24 7y ago
  Don't trust closed source software for encryption.
tantalor 7y ago
> they’re end-to-end encrypted so not even Facebook can’t see your messages Not quite. Facebook still controls the endpoints, so when you see the message so can they. This is obvious: you use their app to view the encrypted message, hence the app has access to the cleartext. https://en.wikipedia.org/wiki/Endpoint_security https://en.wikipedia.org/wiki/Endpoint_security
- fooker 7y ago
  This seems like a extreme argument. If the app is not phoning home with the cleartext, this seems okay. You need some software to retrieve/read text anyway, so this becomes an exercise about trusting trust, etc.
  - TimTheTinker 7y ago
    > This seems like a extreme argument. Not at all. Good security often involves some black-and-white thinking, which not everyone is accustomed to. If Facebook controls the endpoint, then they have the power to access the plaintext, full stop. Using their product (hopefully) implies a choice to trust them not to abuse such access.
    - gimmeThaBeet 7y ago
      > Using their product (hopefully) implies a choice to trust them not to abuse such access. Which is what...they said?
    - ip26 7y ago
      Although I argue the black-and-white "everyone is a potential adversary" thinking is misguided. Your threat model determines requisite security measures, and you usually have to trust someone. (Although Facebook should probably not be that someone)
    - fooker 7y ago
      Ok, what about the closed source hardware in the phones? Would you argue against all encryption because clearly the CPU maker has a similar access to all decrypted content?

SilasX 7y ago

Why is everyone so confident Facebook hasn’t already backdoored it?

bytematic 7y ago
Not sure the fallout of the public finding out would be worth it over the value add of reading messages, maybe I'm wrong but that's how I would look at it.
excalibur 7y ago
They have in a manner of speaking. The communication channel is still encrypted, they just run their surveillance algorithms directly on your device. https://www.forbes.com/sites/kalevleetaru/2019/05/05/facebook-just-gave-repressive-regimes-the-ultimate-surveillance-blueprint/ https://www.forbes.com/sites/kalevleetaru/2019/05/05/faceboo...
- throwaway824721 7y ago
  That Forbes article was wrong: https://news.ycombinator.com/item?id=20587643 https://news.ycombinator.com/item?id=20587643
  - driminicus 7y ago
    Facebook says in a hn post that the article is wrong, but I have no real reason to trust Facebook, given their track record.
    - mentat 7y ago
      > if we ever did it would be quite obvious and detectable that we had done it. It's running in your device, you don't have to trust them if you have technical skill.
      - driminicus 7y ago
        I have little desire to decompile every update and/or constantly analyse what their app is doing. They've proven to be untrustworthy on multiple occasions, and haven't given me much reason to think they've changed. They might convince me if they open their client and server code, but even then they're yet another walled garden only interested in keeping their monopoly by building inferior products and using regularly capture to prevent any competition from doing the same thing they did to MySpace.
      - bduerst 7y ago
        You can't read encrypted packages being sent by the app. The message telemetry could be bundled by the app with other telemetry and you wouldn't know despite your technical skill.
  - badrequest 7y ago
    only if you choose to believe Facebook it was
  - SilasX 7y ago
    I don't consider a self-serving assurance from a company representative to be conclusive proof.
likpok 7y ago
People regularly reverse engineer the Facebook apps to see what’s inside. (For example: Jane Wong)
nighthawk24 7y ago
Don't trust closed source software for encryption.

tantalor 7y ago

> they’re end-to-end encrypted so not even Facebook can’t see your messages Not quite. Facebook still controls the endpoints, so when you see the message so can they. This is obvious: you use their app to view the encrypted message, hence the app has access to the cleartext. https://en.wikipedia.org/wiki/Endpoint_security https://en.wikipedia.org/wiki/Endpoint_security

fooker 7y ago
This seems like a extreme argument. If the app is not phoning home with the cleartext, this seems okay. You need some software to retrieve/read text anyway, so this becomes an exercise about trusting trust, etc.
- TimTheTinker 7y ago
  > This seems like a extreme argument. Not at all. Good security often involves some black-and-white thinking, which not everyone is accustomed to. If Facebook controls the endpoint, then they have the power to access the plaintext, full stop. Using their product (hopefully) implies a choice to trust them not to abuse such access.
  - gimmeThaBeet 7y ago
    > Using their product (hopefully) implies a choice to trust them not to abuse such access. Which is what...they said?
  - ip26 7y ago
    Although I argue the black-and-white "everyone is a potential adversary" thinking is misguided. Your threat model determines requisite security measures, and you usually have to trust someone. (Although Facebook should probably not be that someone)
  - fooker 7y ago
    Ok, what about the closed source hardware in the phones? Would you argue against all encryption because clearly the CPU maker has a similar access to all decrypted content?