Hacker News Reader

Comment by nindalf | Hacker News Reader

Some folks in this thread are convinced that end-to-end encryption is going away when the article says the exact opposite.

View on HN

Unless they radically change how Facebook messenger works I don't see how it could even be called end-to-end encryption. For it to work how it does now (online and independently through the app) they would have to hold the encryption keys.

They would have to instead tie Facebook messenger to a phone like Whatsapp does and use a web app to send messages directly from the device instead. I don't see how else it could be done and still be called end-to-end encryption.

> Unless they radically change

And according to the article, this radical change is coming. Why is that so hard to believe?

Because there are no details beyond vague promises, and it entails serious restructuring and UX trade-offs that may affect revenue. At the moment, skepticism makes much more sense.

Just to be clear, do you think that the NYT is mistaken, or that Facebook has committed to something that is too difficult to execute due to technical and revenue concerns?

I don't think they committed to anything. It's just vague promises that can be reinterpreted in many ways, most of which can compromise trustworthy e2e encryption while also implementing some form of loophole-ridden e2e encryption.

Yeah, WhatsApp is e2e encrypted by default, but it also automatically backs up all your chat history encrypted using a WhatsApp-owned private key. Sure, you can opt-out of backups, but will your peers do as well? Without a clear spec, I think it's perfectly reasonable to be very skeptical of what will be the final product of this operation.

> just vague promises

Now I know you didn't read the article. There were no promises made because this was based on conversations with employees, not a press release.

I came to the comments to see how this can even be done. It seems like a classic case of a CEO promising something that engineering can't deliver, but Zuck is quite technical himself so I'd be surprised by that.

AFAIK, end to end encryption can't really support having multiple clients all using the same account. For example, WhatsApp's web interface is sort of wonky and goes via the phone, to get around the limitations, and I can't really see that being a solution here.

Of course, "end to end" encryption from a Messenger on the website is sort of meaningless anyway.

> AFAIK, end to end encryption can't really support having multiple clients all using the same account.

Improving your AFAIK here. Signal Desktop works independently without proxying communications through the phone (which is what WhatsApp does). Wire supports multiple platforms (Windows, Mac, mobile) and syncs chats across all of them with end to end encryption. There are different ways to do this. It's just that WhatsApp didn't implement it.

Oh interesting, thanks! Do you have any references on how Signal Desktop works and keeps the messages in sync across clients? Do they have separate keys, etc?

Zuckerberg and Facebook deserve the highest degree of scepticism.

Reply on news.ycombinator.com