Expanding Features for End-to-End Encryption on Messenger

Be ready for an expansion of their fear-mongering ad campaigns about how anyone in your office or home can read your messages when you send them unencrypted.

The value? They don't need to secure their databases against external AND internal attacks (believe it or not, fb has protections in place so that employees don't randomly access user data), they can more easily be compliant with the never-ending stream of regulations like GDPR, and... they can more easily do interop with WhatsApp (which doesn't have plaintext messaging).

I think you're missing how information is extracted and what E2EE means. Most of the machine learning models work off of metadata and so the actual content of the messages isn't exactly necessary. Yes, they can help, but it is also often a lot of noise. They've probably found and experimented with WhatsApp and found that they are able to extract enough information through the metadata that they can still maintain high accuracy on inferences. So why not make the PR stunt and move towards encryption? It actually does do some good for people (also note that Twitter has been talking about E2EE messages, though remember that they partnered with OpenWhisper very early on...).

This is really the main difference between the technical aspects of Signal and WhatsApp. Both use the same E2EE protocol but Signal does not capture metadata. We need to remember that metadata is essentially all the information a private investigator would have on you if they followed you around but could not hear the actual content of any conversations you had with the people that you meet. But they would know who you meet, how often, where, etc. Metadata is pretty useful data.

Download signal.

1. liability reduction

2. interop with WhatsApp

3. marketing

4. added security for their users :D

Even a closed source client soon has opensource 'compatible' clients. To build those, you need to reverse engineer/understand the crypto. In the process of doing that, you will likely uncover any systemic flaw that reveals every conversation to a passive attacker.

That effectively leaves the 'send a secret message to leak the key' type backdoors that the client could have. However, if this functionality existed and was used on every chat, then it is quickly discovered by anyone debugging the unofficial client.

So the only remaining 'loophole' is that there is a backdoor in the official client, but that it is only used very rarely or on request.

That in turn means that facebook can't go do large scale data mining on the private chats. Thats a win.

Open source client doesn't matter in mobile world, as you never compile the app yourself. This is only misleading to the non-tech users who don't get how the whole thing works. That's why Telegram's claim of security is total garbage because while their client is "open source", the backend is that has all the messages is not. Something they don't clearly state on their website.

So the Telegram's admins can read all the messages in plain text on the backend. So "open source" client means absolutely nothing for the security.

To the extent open source matters at all when looking at E2E encryption, it theoretically makes it easier to see whether the source code implements a secure protocol. This sounds much more useful than it actually is. For one thing, almost nobody is compiling the source code themselves, so you're ultimately going to have to evaluate the security of compiled code anyways. Also there is an incredibly vast gap between the promise and reality of the open source promise in terms of finding security problems. Accidental or deliberate weaknesses can be subtle and hard to find whether or not you have the code. The extensive history of serious cryptographic problems living in open source code for years before they were found and people regularly being able to find problems in software despite it being closed source suggests open source as a security panacea should be taken with a large grain of salt.