News for hackers. Stuff that matters.
Re:Facebook Tells Barr It Won’t Open Up Encrypted Messages by bduerst on Tuesday December 10, 2019 @04:59PM (#21757310)
The Facebook app can read the messages just as you do when the app decrypts the messages locally.
Re:Facebook Tells Barr It Won’t Open Up Encrypted Messages by SolarNet on Tuesday December 10, 2019 @05:28PM (#21757567)
Sure, but the facebook app doesn't do that (or at least no security researchers have noticed it doing that). The point facebook is making is that if they had a backdoor that let them read the messages that it could be used for other purposes.

Consider that right now to intercept end2end encrypted messages (and lets just assume facebook has that) a malicious actor has to get physical possession of your device, which implies that you have to be specifically targeted. With a backdoor malicious actors would then be able to target many other things, including for example facebook's servers, to access those messages (and all of them at once). I think simply avoiding the bad PR of "hackers downloaded everyone's messages between 2017 and now" is most of why they want this stuff end to end encrypted.

Re:Facebook Tells Barr It Won’t Open Up Encrypted Messages by noelsusman on Tuesday December 10, 2019 @09:21PM (#21758995)
But there already is a backdoor that lets them read the messages. Facebook actually implementing the functionality to take advantage of that backdoor doesn't change anything. The security of your message relies on the security of Facebook's infrastructure either way.

If Facebook implements a switch in the app that would send your decrypted messages back to them, then a malicious actor would have to compromise Facebook to obtain those message. Right now, a malicious actor can obtain your messages by compromising Facebook and implementing that switch themselves. From a security standpoint that seems identical to me.

Re:Facebook Tells Barr It Won’t Open Up Encrypted Messages by bduerst on Tuesday December 10, 2019 @06:30PM (#21757978)
Absence of evidence is not evidence of absence.

The app can bundle the message telemetry with the rest of the encrypted app telemetry when it phones home and even the best security researchers would not detect it. It can also process it locally for profiling and other advertising means.

Re:Facebook Tells Barr It Won’t Open Up Encrypted Messages by schoen on Tuesday December 10, 2019 @07:37PM (#21758377)
> even the best security researchers would not detect it

By examining only the network traffic, sure, but what about by examining the code?

Re:Facebook Tells Barr It Won’t Open Up Encrypted Messages by bduerst on Tuesday December 10, 2019 @08:02PM (#21758539)
Is the facebook app open source?
Re:Facebook Tells Barr It Won’t Open Up Encrypted Messages by schoen on Tuesday December 10, 2019 @08:54PM (#21758864)
Nope!

That hasn't necessarily stopped people from learning something about how it works, though.

Re:Facebook Tells Barr It Won’t Open Up Encrypted Messages by chopin on Wednesday December 11, 2019 @03:32AM (#21760628)
true, but does someone do it? I remember that auditing Truecrypt was already a substantial deliberate undertaking.

And that' not even taking into account that it might be possible to push something different to each user.