While I support strong E2E encryption, I am not sure I buy this argument. Why couldn't they use an escrow key secured in the same ways as update signing keys? Or why couldn't they be compelled to silently push a special update that exfiltrates all of my messages in plaintext?

Virtual fort knox would be impossible to secure. In the modern age, whether through stupidity or malice, those keys WOULD be stolen, leaked, breached, what have you. Hell, the first time the US government tried this situation, the clipper chip, it was trivially bypassed and shown to be utterly broken by researchers

Sure, Clipper was a disaster, but we've learned a lot about encryption since 1998. I still think key escrow and gov't backdoors are probably a bad idea, especially when you look at the US's privileged position in the internet, which should really be a global or jurisdiction-free space. However, I don't understand why it would be so much harder to protect these keys than the update signing keys that Apple, Google, Microsoft, etc (not to mention every app author including Facebook) already have to protect in order to prevent malicious actors (including nation states) from trivially bypassing all security protections by pushing a signed update to the end-user device.

Honestly if your security model involves hiding from the FBI/NSA, you should not be using a cell phone to do your encryption/decryption. That device runs closed-source blobs and can be remotely configured, accessed, and updated by (at least) your carrier and the device manufacturer.

Don’t Apple, Google and Microsoft already have keys that can be used to automatically update and backdoor any of the billions of devices running their OSes?

Make it distributed.

Have each phone generate a public/private key pair, and upload the public key to an anonymous repository.

To escrow a key the client app uses a secret sharing system to generate 10000 key shares, with any 500 key shares being sufficient to reconstruct the escrow key. It encrypts each share with a randomly chosen public key from the anonymous repository. It sends these encrypted shares to the government.

If the government wants to recover the escrow key, it has to make a public request for help in which it publishes the 10000 encrypted key shares. Have an app on the phone that can receive notification of such requests, and if it sees that your public key was used for one of the shares it asks you if you approve the government's request to recover the escrow key, and presents the government's argument in favor of this.

If you approve, the app on your phone decrypts the share, encrypts it with a government key, and uploads it anonymously to the government.

In effect, this system provides a jury of 10000 randomly chosen anonymous phone users to review the access request, and 500 of them have to approve in order for access to be granted.

Relying on people who are actively using phones, to find time to make carefully consideted and measured judgements in the name of justice is ridiculous. Full stop.

Has Apple, Google, or Microsoft ever lost the private key for signing code for delivery on devices?

Not saying this is a good idea, but big tech seems to have figured out how to keep a number secret. This argument may not be very strong as a result.

Windows update was subverted previously, but it was a man in the middle attack: https://www.wired.com/2013/03/flame-windows-update-copycat/

ASUS did actually deliver a malicious update: https://www.vice.com/en_us/article/pan9wn/hackers-hijacked-a...

> why couldn't they be compelled to silently push a special update that exfiltrates all of my messages in plaintext?

See the FBI vs Apple case from a few years ago for an analysis of that.

> Why couldn't they use an escrow key secured in the same ways as update signing keys?

I would expect a key escrow service implemented to the same standards as current large PKI deployments (CPUs, mobile devices, CAs, large software distributions, etc) to be reasonably secure.

However!

* It further enables "turnkey authoritarianism" if and when an abusive regime comes to power.

* It introduces a single point of failure where there isn't one currently.

* It introduces complicated legal compliance issues where there aren't any currently.

* It isn't at all clear how it would relate to decentralized services. (It isn't even clear to me how GDPR is supposed to interact with things like Mastodon and Matrix.)

* It wouldn't actually be useful, because non-escrowed encryption (and stenography in case such is entirely outlawed) are both _readily available_ to actual criminals.

tl;dr: I don't live in China. Let's keep it that way.

It might be possible for the US to successfully hang onto the keys, at least for a while, but you'd have to hand out keys to dozens governments. Given the general level of corruption in the world, some of those would probably be perfectly happy to sell access.

I hear this all the time but I don't understand why it's true. The security of your encrypted messages already relies on the security of the company providing the service. Facebook (and any other messaging app) can read all of your messages in plain text. Otherwise they wouldn't be able to display them to you. Allowing the government to get a warrant to retrieve those messages changes nothing about the overall security of the messaging platform.

What am I missing?

Facebook can't read the content of your messages. They can serve you an encrypted version of your messages that your device can decrypt. Look up end-to-end encryption for how exactly that works.

They can't read them in transit, but if you use Facebook's app to decrypt the message (which is the only option) then obviously Facebook can read your messages if it wants to.

While this is true, the app is a client whose code and behaviour can be analysed by end users to validate that it is not behaving nefariously. The same cannot be said for FB's servers or the data in transit, which is solved by E2EE.

The Facebook app can read the messages just as you do when the app decrypts the messages locally.

Sure, but the facebook app doesn't do that (or at least no security researchers have noticed it doing that). The point facebook is making is that if they had a backdoor that let them read the messages that it could be used for other purposes.

Consider that right now to intercept end2end encrypted messages (and lets just assume facebook has that) a malicious actor has to get physical possession of your device, which implies that you have to be specifically targeted. With a backdoor malicious actors would then be able to target many other things, including for example facebook's servers, to access those messages (and all of them at once). I think simply avoiding the bad PR of "hackers downloaded everyone's messages between 2017 and now" is most of why they want this stuff end to end encrypted.

But there already is a backdoor that lets them read the messages. Facebook actually implementing the functionality to take advantage of that backdoor doesn't change anything. The security of your message relies on the security of Facebook's infrastructure either way.

If Facebook implements a switch in the app that would send your decrypted messages back to them, then a malicious actor would have to compromise Facebook to obtain those message. Right now, a malicious actor can obtain your messages by compromising Facebook and implementing that switch themselves. From a security standpoint that seems identical to me.

Absence of evidence is not evidence of absence.

The app can bundle the message telemetry with the rest of the encrypted app telemetry when it phones home and even the best security researchers would not detect it. It can also process it locally for profiling and other advertising means.

> even the best security researchers would not detect it

By examining only the network traffic, sure, but what about by examining the code?

Is the facebook app open source?

Nope!

That hasn't necessarily stopped people from learning something about how it works, though.

true, but does someone do it? I remember that auditing Truecrypt was already a substantial deliberate undertaking.

And that' not even taking into account that it might be possible to push something different to each user.

They read the plaintext from the keyboard. Then the app can send it to them. The problem is how to prevent people to look into the network traffic (encryption?) and to decompile the app.

>Facebook (and any other messaging app) can read all of your messages in plain text

The point of end-to-end encryption is that this is not supposed to be true

Since they control the plaintext -> encrypted transition, theoretically they could copy the plaintext payload in the encryption process. If this were hidden (say via steganographic means), it might not be detectable.

But it is true because all end-to-end encrypted messaging apps today have both ends being ... an app written by the service provider, which gets the public keys from ... the service provider.

Do you know WhatsApp encrypts your messages? Or do you just believe it because Facebook said so? How would you tell if the app was modified to disable it? Do you decompile and audit every binary sent to you by the Play Store? What abut the binaries your peers were sent? And what if their key directory served you a wrong key?

E2E encryption isn't useless, but I see a whole lot of technical people confused about why it's useful. Namely, it's a legal/political hack. The law says the government can make you hand over data you have. It doesn't say the government can force you to make arbitrary changes to your life or business to enable them to have whatever data they want. Obviously this would be two very different laws with very different impact: specifically, it would be a law enabling law enforcement to compel arbitrary action. Such laws are extremely rare and usually tightly limited.

But if such a law were to be passed, the technical infrastructure becomes useless. FB could just be forced to switch it off.

In the case where you’re using a centralized service provider with closed source clients written by the same company... sure. E2E crypto does not absolve you of the responsibility of ensuring you trust the client.

In an ideal E2E encrypted system the private keys should never be readable outside the systems you trust. The keys can be encrypted using personal credentials (like a password) and stored on the cloud. A simplified login flow looks like this: 1. download your encrypted keychain, 2. decrypt it using your personal credentials, 3. fetch encrypted data and decrypt it using your keychain.

But you still have to trust the application that does all this behind the screen to not leak your decrypted keychain or personal credentials. Facebook's messenger app is closed source so who knows that's happening there.

Facebook isn't the best example of anything really. There's plenty of services that encrypt messages end-to-end without the ability to "unlock" the message by the service itself. What I don't understand is the argument or case being made that giving anyone the ability to break encryption is a good thing. Smells to me more like ulterior motive to just get the backdoors put in. This isn't actually going to protect anyone any better. Governments have already long had tools to subvert things in various ways regardless of the need to actually break encryption. Why are we arguing for a larger surveillance state?

“Can” as in “I can change how my software is built so that in the future I will be able to” is different from “can” as in “there is nothing preventing me from doing this right now except the time it takes”.

Facebook “can” read messages in the former sense, but apparently not the latter.

I think the distinction is a meaningful one, legally.

That's why I'm confused about Facebook claiming it's impossible. It seems clearly possible without compromising anything about the current level of security on the platform. They would have to develop specific functionality for it, but it is possible.

Yes, and it’s possible for me to plant lettuce underneath my apple trees and deliver romaine to people in 10 weeks.

But the courts can’t force me to do that.

They can force me to turn over lettuce that’s already in the ground.

In both cases I “can” deliver a hundred pounds of lettuce to the courts. But the courts can only demand things I already possess. Not “whatever I am capable of collecting”.

You're missing the storage location of the private keys.

I do too.

However, one thing I'd be curious to learn more about from this community...

Facebook Messenger isn't encrypted now. What are the biggest examples where that has hurt users. I'm sure it happens, maybe frequently, but one thing that's impossible to get a sense of is the SIZE of the tradeoffs here. What's the biggest thing that's happened that we know about?

Listening to the tech lawyers today at the Senate hearing, the pro-privacy side hasn't made a clear argument about just how bad it is now in FB's case, and just how bad it was before several years ago in Apple's case.

(For FB you can understand why they wouldn't want to say their current system is a nightmare for users. Also, I understand a backdoor is different from the status quo or previous setups... not asking about a backdoor here.)

Messenger is encrypted, just not by default. You have to choose "private conversation" to encrypt. This is probably the right choice for most users since they'd rather have access to their messages across devices than e2e encryption.

Since I'd imagine, then, that 99% or more aren't encrypted, what has been the biggest issue that has resulted from this? We could then judge that against the negative outcomes of law enforcement not having access to, say, WhatsApp messages.