7 ms·
I'm not sure if this meets the bar for substantive and thoughtful discussion, but this kind of corporate cowardice, enforced by unelected bureaucrats standing a
by milderworkacc 4mo ago
I'm not sure if this meets the bar for substantive and thoughtful discussion, but this kind of corporate cowardice, enforced by unelected bureaucrats standing at the bully pulpit is only going to get worse as the noose tightens on the open web.
The combination of hardware attestation and walled garden "app stores" is the end goal of most policymakers in this area, and it happens to suit the monopolists in Google and Apple and Facebook down to the ground.
Perhaps a timely reminder that things do not always get better over time, and that we may have lived past the high point of secure communications in our lifetime.
- chadgpt2 4mo agoDo people expect that Instagram can't read their Instagram private messages? I don't think people expect that. And E2EE is not nearly as cheap as the HN crowd likes to pretend—how do those devices get those keys if not through a central service? Especially if one of them is a web browser?
- onemoresoop 4mo agoOk, so drop all pretense then and blatantly scavenge through private conversations? Then take whatever from there and maybe sell it to highest bidder?
- ryandrake 4mo agoI would expect any message facilitated by a company's software, and going through that same company's servers to be compromised.
- mrexcess 4mo agoThe answer to most everyone question you’re asking is just, “public key cryptography”. It’s kind of disheartening to me that such basic 1990s tech as implemented by Phil Zimmerman is now obscure enough to merit questions like this. Both parties exchange public keys through the central service. Only the possessor of the respective (on device, Secure Enclave ideally) private keys can decrypt the messages encrypted to the public key. The process can also work in reverse, encrypting with the private key so only holders of the public key can decrypt: this is called “signing”.
- feurio 4mo agoAnd how does one verify that the public key received belongs to the intended party, rather than a mitm? If the answer is blind trust in a third party that runs the messaging service then I suspect that you can guess what the people asking those questions are really asking.
- danparsonson 4mo agohttps://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exc... If Meta are turning it off then I guess it's reasonable to assume that there is something to turn off.
- tardedmeme 4mo agoHow would the keys get stored in the user's private browsing window? Do they lose all chat history when they log in on a private browsing window and then close it?
- danparsonson 4mo agoI don't know the technical details of that for sure, but I think the answer is that keys and chat history are stored on-device only; for example you lose your WhatsApp history if you don't restore a backup when moving to a new phone. If a messaging app is showing you message history in a private browsing window then perhaps the encryption key for that history is derived from your password or something like that; that can be done locally so that all the server ever sees is encrypted data.
- tardedmeme 4mo agoIf you log in to the app on one phone and then in a web browser should you still be able to see your messages in the web browser?
- 4mo ago
- torben-friis 4mo ago>Do people expect that Instagram can't read their Instagram private messages? I don't think people expect that. A deeper question is why we reached a point where people can't reasonably expect their communication to not be spied on.
- dmbche 4mo agoPRISM?
- Slash65 4mo agoPeople, or at least Americans, didn’t care in 2012 when the Snowden reveal happened. We’ve been at that point for over a decade now.
- 2ndorderthought 4mo agoConsidering the average person thinks that opening websites in incognito means no one knows they visited them, I would agree.
- sharyphil 4mo ago"Be wary of malicious software that tracks your keystrokes in exchange for free smileys"
- lovich 4mo agowere like 20 years past that, at the very least 10 years with Snowden. The people have spoken, caring about your communications not being spied on puts you in the minority. I mean like, just look at social media. You have tons of people who not only don't care about being spied on, they actively document everything for more views.
- traderj0e 4mo agoExactly. E2EE comes with UX consequences that you can't just bolt on later. There might be something to be outraged about, but this alone isn't it.
- SlinkyOnStairs 4mo agoIt's not just "the death of the open web". These decisions are made whilst America is falling to fascism. Meta may not intend for the abolition of E2E encryption to make fascist crackdown on free speech easier, but that is the reality of what abolishing E2E encryption does. DHS is already subpoenaing tech companies for the information about users who criticize ICE. https://www.nytimes.com/2026/02/13/technology/dhs-anti-ice-social-media.html https://www.nytimes.com/2026/02/13/technology/dhs-anti-ice-s... The "walled garden" isn't even that big a concern anymore. The gestapo reading every single digital communication you have and showing up to harass, threaten, or simply disappear you into a camp if the infraction is severe enough. That is what's at stake here.
- lyu07282 4mo agoThis is getting pushed in the EU too, the crucial thing to understand about where the road is headed: the goal is the inverse of who does the illicit content scanning. The idea is the government gives a list of illegal activity/speech to the platforms (such as anti-ICE activism or speaking in support of Palestinians) and then the platforms scan (presumably with LLMs) all public and private messages, deletes them and forwards them to federal and local law enforcement of the user. This is why E2E is under attack everywhere, because it makes that impossible.
- Aerroon 4mo agoHardware attestation really sounds like one of the worst things that could've happened to computers.