If either user’s device is compromised, unbreakable encryption is of little relevance. This is why surveillance operations typically focus on compromising end devices, bypassing the encryption debate entirely. If a user’s cleartext keystrokes and screen captures can be streamed off their device in real-time, it matters little that they are eventually encrypted for transmission elsewhere. Facebook announced earlier this year preliminary results from its efforts to move a global mass surveillance infrastructure directly onto users’ devices where it can bypass the protections of end-to-end encryption.
In Facebook’s vision, the actual end-to-end encryption client itself such as WhatsApp will include embedded content moderation and blacklist filtering algorithms. These algorithms will be continually updated from a central cloud service, but will run locally on the user’s device, scanning each cleartext message before it is sent and each encrypted message after it is decrypted.
The company even noted that when it detects violations it will need to quietly stream a copy of the formerly encrypted content back to its central servers to analyze further, even if the user objects, acting as true wiretapping service. This allows them to intercept your messages and pass them on to any 3rd party without you knowing.
So be very wary when you hear a vendor touting end-to-end encryption. What you want to ask is two questions:
1. Am I the only one who has the encryption/decryption key, can I use my own key?
2. If I lose my password can the vendor reset it for me so I can see my messages? If the answer is yes then the vendor has a decryption key.
You either have true user-owned end-to-end encryption or you do not. There is no half-security. You’re secure or you are not secure.
#security #facebook #encryption
#^The Encryption Debate Is Over – Dead At The Hands Of Facebook
The sad reality of the encryption debate is that after 30 years it is finally over: dead at the hands of Facebook.