undefined | Better HN

0 pointsMoodles5y ago0 comments

> Whatever they say, they have the keys to decrypt it.

This is a baseless assertion.

0 comments

godmode20195y ago

In Australia its illegal to encrypt user data with out the ability to decrypt it.

Do they offer this service in Australia? Yes. Then they have the keys.

RandallBrown5y ago

Facebook isn't doing the encrypting. You are. You have the key on the phone.

34kj2h42345y ago

You could also have the law enforcement public key that was compelled to be installed in your corespondent keyring, invisibly, re-encrypting all those messages for FB, LEA and IC. That way its all "end-to-end encrypted" and giant public messaging system can be selectively tapped by authorities. Everyone loses!

Barrin925y ago

as of a few months ago[1] it seems like Facebook and other tech companies haven't complied with it yet. I think governments are still just pestering them about it.

[1]https://www.independent.co.uk/life-style/gadgets-and-tech/go...

seniorivn5y ago

but it is a safe assumption

sweis5y ago

It's a falsifiable assumption. Audit the binaries if you want to convince yourself. You will see code to generate and use keys locally, with no mechanism to fetch or share keys from a server.

If you want to go beyond generic concerns, there are plenty of academic papers that have looked at Facebook Secret Conversations, found actual issues, and helped get them fixed: https://link.springer.com/article/10.1007/s00145-020-09360-1 https://link.springer.com/chapter/10.1007/978-3-319-63697-9_... https://link.springer.com/chapter/10.1007/978-3-319-96884-1_...

na855y ago

Why are you so eager to trust an organization that has so often demonstrated it's not worthy of trust?

This is Facebook, for pete's sake. The same company that conducted psychological experiments with zero clinical/ethical oversight by manipulating its users' feeds to see if it could cause depression/anxiety (or the opposite).

Facebook is evil and you should not trust them even a little bit.

1 more reply

mattigames5y ago

The app can auto-update itself at any time and install some binaries that do share the key with the server; trust is virtue of every single thing the company (im this case FB) can do and auto-updates is one of them.

snypher5y ago

"When you report a secret conversation, recent messages from that conversation will be decrypted and sent securely from your device to our Help Team for review."

So they either have the keys or a way to force the client to decrypt.

colejohnson665y ago

Or it’s decrypted on your side, and you reporting it sends the decrypted form. How else would a “report” button work if not with unencrypted data? Not everything is a conspiracy.

arrosenberg5y ago

Trust is earned.

j / k navigate · click thread line to collapse