Hacker News Reader

Comment by yholio | Hacker News Reader

This is fundamental. If Facebook messages are still to work as before, with a web interface, an archive etc. then you need to supply Facebook servers with a decryption key. You no longer have end to end encryption.

And I don't really see how they could get rid of the web features, it represents a massive number of FB Messenger users. This ties nicely with the older pressures from Zuckerberg to monetize WhatsApp and the resistance of the founders for security reasons, this most likely means access to the conversation plaintext.

View on HN

WhatsApp Web already provides this, by connecting to the phone and proxying messages through it. Of course, that also requires implicit trust in WhatsApp Web, but it is possible. And using WhatsApp requires implicit trust in Facebook anyway, so...

It still requires you to run the WhatsApp phone app though. I doubt that facebook wants to require all of their users to have phones. You can reimplement WhatsApp's functionality in client side JS but then you get into deep technical problems rooted from the fact that js is, in general, ephemeral and not something permanent compared to an ios/android app. E.g. when someone logs onto facebook on a their friend's computer to check their messages you want everything to be smooth including message search but in order to provide message search, either the server needs access to the plaintext or the client needs to download the entire message history... If there's an app the client already has the entire history so that's no problem, but it is a problem with ephemeral Javascript. Another problem you run into is that Facebook can serve specifically manipulated Javascript just for you ^ TM because you are an interesting target or something. For Android/iOS this would require an app update and need to go through a third party and I haven't heard that google or apple give you the option to push a specific app to a specific device.

you could type the key into each client each time, no?

isnt that how things like dashlane work? it sends the encrypted historical blob to your device, your device decodes it.

I don't think such unfriendly UX would ever be considered in such a mainstream service

the OPTION to start an encrypted chat, with a chat specific password?

Or storing the key in localstorage?

i guess by "each time" i was being somewhat ambiguous. it could mean each login, or each install, or each time the session clears.

To enable end-to-end encryption, you need more than local storage, you need local computation using local execution of signed and reproducible code. Javascript in browsers is fundamentally not such a platform, mobile applications are - to the degree you trust Google, Apple etc.

You already have to login with a username and password to access Facebook, unlike whatsapp where your phone is the sole key. Facebook could just construct the key at logon time based on the user's password.

Couldn't the messages be encrypted using the user password?

Reply on news.ycombinator.com