Comment by alexggordon | Hacker News Reader

Comment by alexggordon | Hacker News Reader

> To establish which image is of concern, people will be asked to send the image to themselves on Messenger.

> Once we receive this notification, a specially trained representative from our Community Operations team reviews and hashes the image, which creates a human-unreadable, numerical fingerprint of it.

This clearly implicates that Facebook has, almost without reserve, the ability to read messages from user to user (even though it might limited to messages to oneself), and exposes that ability to its employees.

While I stopped using Facebook a long time ago, Zuckerberg's quote, "they 'trust me'; dumb fucks" seems relevant here. If I were Facebook, I would do this in a different, much more privacy conscious way.

1. Obviously, Facebook is already hashing all images on its platforms and storing the hashes. Given that, let the user, using a frontend only platform, upload an image and generate the hash. Make sure this image is a real photo (not a meme or something heavily photoshopped) in addition to making sure:

1a) The image contains a human[0]. Fairly easily doable for most situations.

1b) If not, let the user know that "we can't automatically detect a human in this photo, do you want to still submit this photo for removal, this could get a strike against your account if (not in some list of reasons for removal)". Maybe the photo has a picture of a credit card or something.

2. Submit the hash to the backend. Given that hash is not used on the platform past a significant amount of views, automatically ban the photo, and allow other users to petition for reinstatement of the photo, knowing that a non-valid petition for reinstatement (the user doesn't have rights to the photo) COULD result in a strike also.

3. Have humans review the petitions, and in cases where the users explicitly allow, the images.

Doing this would limit another human seeing the intimate photo in well over 90% of the cases I'd bet. In addition to that, even if the photo is shared with another human, it would let the end user decide if they'd like a Facebook employee to view the image too. IE, basic user privacy. Come on Facebook. Dumb fucks.

[0] very doable, https://trackingjs.com/

This clearly implicates that Facebook has, almost without reserve, the ability to read messages from user to user (even though it might limited to messages to oneself), and exposes that ability to its employees.

You can view and search your message history on Facebook, so there is not really any question that they have and can read all messages. I never explicitly checked it but at least I never noticed any gaps, i.e. missing messages because I sent them using the Messenger app.

I believe to remember that Messenger is supposed to use Axolotl Ratchet for end-to-end encryption but that is hard to reconcile with the availability of your message history on facebook.com. So maybe it's - quote - end-to-end - unquote - between the phone and the server?

I never really thought about that. Or is it just not available or disabled in my Windows Phone version of the app?

It's not that infeasible to have a web platform that encrypts users messages, just each client gets an encryption key. Look at Telegram, or even FB Messenger end to end encryption. I'm not saying they ever said they didn't have the ability to do it, I'm saying it's weird that they would use "message snooping" as a form of user photo submission.

When I send messages using the Messenger app - which is supposed to use end-to-end encryption, isn't it? - I can see and search those messages on facebook.com. Something does not add up here. And if they have the keys on their servers, then it's rather pointless to use end-to-end encryption in the first place.

facebook only does end-to-end for "secret" conversations started in their mobile app.

[1] https://www.facebook.com/help/messenger-app/1084673321594605...

That explains it and it seems unavailable in the Windows Phone version. And because I never owned or used an iPhone or Android device I was unaware of this difference.

Using Messenger you can start a secret conversation with someone which is encrypted end-to-end. Those conversations only exist in the current device. But regular conversations are not encrypted in any way.

They are sent over an encrypted transport which means law enforcement must subpoena them from Facebook, and cannot monitor them with a telephone intercept like calls and SMSes.

You can download a complete copy of the data Facebook has on you, including all messages you've sent since your account was created [1]. I did this some years ago to graph changes in sentiment with friends.

1. https://www.facebook.com/help/131112897028467

Well, all data Facebook has on you that you uploaded, if other people upload your address, that's apparently their data.

> This clearly implicates that Facebook has, almost without reserve, the ability to read messages from user to user (even though it might limited to messages to oneself), and exposes that ability to its employees.

Why is that surprising? In the absence of end-to-end encryption (not the default for Messenger, and can only be enabled on a conversation-by-conversation basis) where the keys never leave the endpoints, how do you design a system where literally no employee can access particular bits of data?

I'm sure FB doesn't let just any employee read people's messages, and likely such access is doled out on a case-by-case basis, and isn't a global can-read-anything permission.

> This clearly implicates that Facebook has, almost without reserve, the ability to read messages from user to user (even though it might limited to messages to oneself), and exposes that ability to its employees.

Why do you seem surprised by this? I can't fathom anything about Facebook's design that implies my posted content is hidden from employees.

This clearly implicates that Facebook has, almost without reserve, the ability to read messages from user to user (even though it might limited to messages to oneself), and exposes that ability to its employees.

No, it implies that some Facebook employees have the ability to review messages which are reported as being abusive. Which is... well, kind of obvious. I mean, what did you think was going to happen when you report a message?

(I suspect that some employees have the ability to look at far more messages than just the ones which are reported, but that is not implied by what they're telling us here.)

I really don't understand why anyone uses Facebook.

You have a phone, which can communicate with your friends. It's only remotely useful for its near-monopoly on event planning, and imo that's a job for the trustbusters.

> I really don't understand why anyone uses Facebook.

You really cannot? Like, can you not imagine one person, who doesn't realize (or worse, and more likely IMO, does not care) about the privacy implications?

It's not hard to understand at all, I think.

Okay, fine, I don't want to understand; it jives against the charitable way that I want to think about people.

I guess there's a whole lot of cognitive dissonance between how fucking stupid People reliably are and how kind and admirable persons can be, though - I should probably just get used to it.

Compared to a phone (SMS) and other messaging apps (whatsapp, email, signal), fb messenger has two big benefits for me:

* Cross platform: I don't have to type on a tiny screen when I'm in front of a computer, and won't lose my account or my messages if I lose my phone or phone number.

* Discoverability: most people who I meet are on it, so I can reach out to people I meet at events as well as friends of friends.

I don't love messenger. I use Messenger Lite on my phone to avoid most of the snapchat/gif/events/birthdays features. But I'm not aware of any other cross-platform messaging app with that discoverability, let alone one free of privacy issues.

Which is sort of weird, isn't it? As little as 10-15 years ago there was a huge flourishing ecosystem of IM and chat clients, many of which worked together fairly seamlessly. Individual clients like Pidgin would happily amalgamate several platforms together. Now, at least in terms of usage, it's a blasted hellscape of a one-pony show - what happened?

>Cross platform: I don't have to type on a tiny screen when I'm in front of a computer, and won't lose my account or my messages if I lose my phone or phone number.

email isn't cross platform?

>Discoverability: most people who I meet are on it, so I can reach out to people I meet at events as well as friends of friends.

doesn't everyone have an email address?

You can’t just type someone’s name into the To field of an email.

I don’t think that’s accurate. I believe for this specific feature you need to specifically report the message from within the Messenger UI, similarly to how you would report spam or other abuse. Only then is it sent to the human reps. I don’t think other messages are ever read.

I’m a FB employee and it’s definitely not possible for employees to easily snoop on random messages. Even if you found some way that isn’t properly protected, you’d get promptly fired if caught.

No, you have to opt in to this feature, hence consenting to let an employee read your message. It does not imply that they can read messages without your consent.

Reply on news.ycombinator.com