Hacker News Reader

Hacker News

Comment by ejcx | Hacker News Reader

Parent Full thread

ejcx

Says a random tweet from Alex Stamos, who is very well respected in the security community...Oh...and Facebook CSO.

Looks like the FB engineers just pop the URL and check for "https?://"[0] at 0 in the string.

[0] - http://i.imgur.com/AhIpWDe.png

View on HN

It's great to hear from Facebook that we can trust Facebook. /s

I guess it's good to be cynical at times, but do you really think the tweeter and indeed Facebook would put their reputations on the line to gather such a small, insignificant information?

I doubt he's lying, but you have to trust that what he's saying is accurate and stays accurate. Some helpful dev that doesn't get the privacy issues could switch it to process the clipboard on the server, or accidentally add some logging code which happens to log that value remotely.

I'm more concerned that iOS gives this ability without any warning or notification to the user, because even if Facebook is virtuous (now) about this, other future apps may be less so.

It may seem small and insignificant to us, but how much do you think advertisers would pay to see the link that I just pasted into an iMessage, or the contents of the email I just copied?

They would pay significantly less than the billions of dollars Facebook stands to lose if they were found out to do this.

How could this cost them billions? They do lots of things that are pretty gross. Does this cross some sort of line they haven't crossed before?

Wasn't he only just recently CSO (or similar) of Yahoo? What's the story there?

EDIT: found this: http://www.siliconbeat.com/2015/06/24/yahoo-loses-security-c...

Where it is written:

> Stamos also won plaudits this spring at Austin’s South by Southwest festival when he revealed the company will roll out end-to-end encryption for Yahoo Mail by the end of the year.

Except, I don't believe Yahoo ever did "roll out" end-to-end encryption for email?

A Google search or two leads me here: https://github.com/yahoo/end-to-end

Thanks, that's a nice repository. I see that like its parent (Google's end-to-end), it is collecting dust for 99.99% of users.

While I wouldn't consider this very active, it's certainly not collecting dust.

https://github.com/yahoo/end-to-end/commit/8bf5dca239bb1df3f...

It is collecting dust for 99.99% of users. You've linked me to a commit of a merged pull request. That is not an indication that any of Yahoo's users are using this code (unless you count the developers). Maybe Yahoo will actually make their end of year deadline for "all users" [1], we'll see. They have less than two months left to do so. My knowledge of Google's end-to-end attempt leaves me skeptical, and not because this is any sort of a technical challenge, but because it's a political challenge.

[1] http://yahoo.tumblr.com/post/113708033335/user-focused-secur...

Can't make a coherent response, so you hit the downvote button out of frustration. lol.

Reply on news.ycombinator.com