News for hackers. Stuff that matters.
Re:Building end-to-end security for Messenger – Engineering ... by viddi on Thursday December 07, 2023 @05:52AM (#38555053)
Given that E2EE messengers usually require being run on a smartphone as primary device, my guess is that they are trying to push the last remaining non-app-and-web-only users to their messenger app.

I'm one of them and I don't like this.

Re:Building end-to-end security for Messenger – Engineering ... by pxeger1 on Thursday December 07, 2023 @08:10AM (#38555901)
WhatsApp (also by Meta!) supports E2E encryption on the web app.
Re:Building end-to-end security for Messenger – Engineering ... by matthewdgreen on Thursday December 07, 2023 @07:43AM (#38555706)
The end-to-end encryption also works on the web. I’ve used it and it’s excellent. You need to use a PIN to access your past messages from their backup HSMs, but other than that it’s completely transparent.
Re:Building end-to-end security for Messenger – Engineering ... by niam on Thursday December 07, 2023 @08:16AM (#38555959)
If I understand the parent comment right, this was an argument against ProtonMail's End-to-End Encrypted Webmail 5+ years ago.

The argument being that some assurances typically associated with E2EE (that "even we can't see what you're doing") are shakier without a disinterested third party serving the application to the user. If you have some target user `Mr. X`, and you operate the distribution of your app `Y`, you could theoretically serve them a malicious app that sidesteps E2EE. And since it's just a web app: the blast radius is much smaller than if you were to go through the whole update process with Google or Apple and have it distributed to all users.

Re:Building end-to-end security for Messenger – Engineering ... by viddi on Thursday December 07, 2023 @11:32AM (#38558373)
Do you know if E2EE also works on the web without having to install the app? That would be novel.
Re:Building end-to-end security for Messenger – Engineering ... by matthewdgreen on Thursday December 07, 2023 @12:45PM (#38559384)
Yes. It does.
Re:Building end-to-end security for Messenger – Engineering ... by asah on Thursday December 07, 2023 @06:04AM (#38555111)
??? FB Messenger is available on facebook.com ?
Re:Building end-to-end security for Messenger – Engineering ... by viddi on Thursday December 07, 2023 @06:53AM (#38555400)
Yes, and my guess is that they are planning on removing the standalone messenger from the web version. You'll probably need to have the FB Messenger app installed on a smartphone device in order to use E2EE. That would make it impossible to write messages on the web version (i.e. facebook.com) without having an app installed. I currently do not have the app installed and am able to write messages on the pure web version of FB on desktop. My guess is that they are enabling E2EE to get the last remaining desktop-only-and-website-only messenger users to install the app. Hope that cleared it up.
Re:Building end-to-end security for Messenger – Engineering ... by skybrian on Thursday December 07, 2023 @07:00AM (#38555444)
According to the article, they went through a lot of trouble to make it work in web browsers. It would be odd to drop it after doing that.
Re:Building end-to-end security for Messenger – Engineering ... by viddi on Thursday December 07, 2023 @07:28AM (#38555622)
Again, my point is not that FB Messenger will stop working in the web browser altogether. My point is that FB Messenger will stop working in the web browser if you don't have the FB Messenger app installed on your smart phone as the primary device.
Re:Building end-to-end security for Messenger – Engineering ... by jessehattabaugh on Thursday December 07, 2023 @07:02AM (#38555460)
OA mentions bringing E2EE to web clients
Re:Building end-to-end security for Messenger – Engineering ... by dspillett on Thursday December 07, 2023 @06:13AM (#38555161)
In a way that works well on low power mobile devices?

Most people I know using FB messenger do so on desktop via facebook.com and the app on mobile. I don't see them removing the former any time soon but if the web only version still exists for mobile users perhaps that will go.

Re:Building end-to-end security for Messenger – Engineering ... by eythian on Thursday December 07, 2023 @06:26AM (#38555235)
You can't use the web version on mobile, it tells you to install the app.
Re:Building end-to-end security for Messenger – Engineering ... by stevage on Thursday December 07, 2023 @09:05AM (#38556439)
Or if you have to use desktop mode in your browser...