Yesterday Meta announced that they have begun rolling out default end-to-end encryption for one-to-one messages and voice calls on Messenger and Facebook.
It will bring strong encryption to over one billion people, protecting them from dragnet surveillance of the contents of their Facebook messages.
Governments are continuing to attack encryption with laws designed to weaken it.
With authoritarianism on the rise around the world, encryption is more important with each passing day.
Strong default encryption, sooner, might have prevented a woman in Nebraska from being prosecuted for an abortion based primarily on evidence from her Facebook messages.
This introduction of end-to-end encryption on Messenger means that the two most popular messaging platforms in the world, both owned by Meta, will now include strong encryption by default.
For now this change will only apply to one-to-one chats and voice calls, and will be rolled out to all users over the next few months, with default encryption of group messages and Instagram messages to come later.
Choosing between these options is important for your privacy and security model, and we encourage users to think about what they expect from their secure messenger.
The technology behind Messenger's end-to-end encryption will continue to be a slightly modified version of the Signal protocol.
When it comes to building secure messengers, or in this case, porting a billion users onto secure messaging, the details are the most important part.
Backups are important for users who expect to log into their account from any device and retrieve their message history by default.
From an encryption standpoint, how backups are handled can break certain guarantees of end-to-end encryption.
WhatsApp, Meta's other messaging service, only provided the option for end-to-end encrypted backups just a few years ago.
Meta is also rolling out an end-to-end encrypted backup system for Messenger, which they call Labyrinth.
Encrypted backups means your backed-up messages will be encrypted on Facebook servers, and won't be readable without your private key.
If an app is forward-secret, then you could delete all your messages and hand someone else your phone and they would not be able to recover them.
Choosing the right secure messenger for your use case.
There are still significant concerns about metadata in Messenger.
By design, Meta has access to a lot of unencrypted metadata, such as who sends messages to whom, when those messages were sent, and data about you, your account, and your social contacts.
None of that will change with the introduction of default encryption.
This Cyber News was published on www.eff.org. Publication date: Thu, 07 Dec 2023 17:43:05 +0000