Facebook and PGP

149 points by alexweber 11 years ago | 59 comments

michaelt 11 years ago |

Another possibility is one of their programmers thought "It would be good if there was more encrypted e-mail going around in general, I wonder if I can get it into facebook somehow" and coded this feature in their free time. Then convinced his managers to integrate it with that argument plus "and it's already coded we just need to merge it in"

bostik 11 years ago | |

Well, from what I know there are some seriously privacy minded people in there. As oxymoronic as that sounds.

But I could certainly see some benefits both for FB and for world at large from this. One of the big problems with PGP is how to bootstrap web of trust. "Does this key really belong to this particular person?" But what if the otherwise loathed real name policy could be turned to service this particular need? Prominently visible personalities can attach their PGP keys to their pages and make the first association harder to forge.

Secondly, I have little doubt that the keyservers are monitored. An increase of searches and/or downloads to known activist lawyers' or journalists' keys could have relation to uncomfortable whistles being blown in near future. But what if FB made the keys they have signed available via their own keyserver, and made that reachable over Tor? Downloading a high-profile PGP key is likely to be a fairly big red flag.

And lastly, there may be some positive effects further down the line. I've been using PGP (and later GPG) since 2.3i became available and I know just how horrid the usability is. If FB can iterate over UI and UX issues, then others can learn from those efforts, and eventually we might have something that even a regular person could at least learn to use.

And of course - adding more encrypted noise to global email flow is not a bad thing at all.

I have no doubt that FB sees many non-altruistic avenues if this service catches wind. Wonder is there is anything to relationship graphs with some extremely strong edges...

higherpurpose 11 years ago | | |

Zuckerberg actually cares a lot about his privacy. Yours? Maybe not as much.

http://www.slate.com/blogs/business_insider/2015/05/18/tech_...

http://www.theguardian.com/technology/shortcuts/2015/may/19/...

But isn't the PGP move a sign that Facebook cares about our privacy? Not really. The profile thing makes it easy to discover people who use PGP and email them with encrypted messages, but that has nothing to do with Facebook's content.

As for the encrypted notifications, Facebook can obviously still read those, and it can be useful to protect the data from Google. Also, if more people use PGP for email, that means less data for Google, so I could actually see this being a strategic move, too. Maybe not a huge one, but it doesn't cost Facebook too much to implement this, so why not?

I'll start thinking Facebook actually cares about my privacy when the Messenger uses Axolotl or OTR as well as ZRTP. Until then, I'll remain skeptical of Facebook's privacy intentions.

cbhl 11 years ago | | |

Have you heard of keybase.io?

They don't do Facebook, but you can tie a PGP key to various other public identities (Twitter, GitHub, HN, Reddit, etc.)

A1kmm 11 years ago | | |

> But what if the otherwise loathed real name policy could > be turned to service this particular need?

The link between a real person and a Facebook account isn't secure - I could make an account with your name today without too much stress (no need to provide ID unless Facebook thinks your name isn't a real name).

skrebbel 11 years ago | |

"and it's already coded we just need to merge it in"

Any manager worth their salt will know that maintaining code is 10x more expensive than building it in the first place, and if it's user-facing code you're even adding an implicit promise that the feature isn't going to be removed again. I strongly doubt the "oh but it would be so hard to build that" argument counts for much.

That said, I've no idea about what kind of place Facebook really is.

andrewflnr 11 years ago | | |

Well, it's possible that "move fast and break things" is more than just hot air. :)

rubzah 11 years ago | |

This is by far the most likely reason. When you hire top developers, those developers want to work on interesting stuff. If retaining those people is a priority, the middle manager's only option is to smile and nod when they tell him something they'd like to do, or he'll soon find himself without employees, and shortly after without a job.

Just look at all the shit that comes out of Google, not as part of some grand overarching scheme, but because someone thought it would be fun, and more often than not forgotten about a year later.

alexbecker 11 years ago |

To me the strangest thing about this announcement is that, while the PGP user base is small, I imagine its intersection with Facebook's is much, much smaller. PGP is used by people who are extremely concerned with privacy, which is practically the antithesis of Facebook.

rrockstar 11 years ago | |

That is why I suspect this is mainly a PR move by Facebook to show they are concerned about your privacy. Although the suggestion in the article about Facebook going in the PGP mail business is much more excited. Not that i would want to host my email on facebook servers, but if they are able to lay the groundwork for usable encrypted email that would be really great.

smackfu 11 years ago | |

It'd be interesting if Facebook let ads be targeted at people with PGP keys.

azag0 11 years ago | |

I agree with the demographics, but I've never understood this connection. With Facebook, the intrusion of privacy happens completely out in the open and you can work with that. By now pretty much everyone concerned knows that they collect and potentially use everything they can. With email interception, on the other hand, that's something you don't have any control over without encryption. So in my mind, I can be a heavy user of Facebook and a heavy user of PGP without any contradiction.

mtbcoder 11 years ago | | |

> With Facebook, the intrusion of privacy happens completely out in the open and you can work with that.

I'm not following. Once I hand over my data I have no real control over how they end up using it behind the scenes. Furthermore, even if I never sign up with Facebook or at some point delete my account thinking my data has been flushed, a "shadow profile" still exists that I have no control over. [1]

[1] http://motherboard.vice.com/blog/facebooks-shadow-profile-bu...

omouse 11 years ago | |

PGP is still useful for signing and verification of identity which is what Facebook is about (the whole real name fiasco).

p4bl0 11 years ago |

The last paragraph of the linked post describes more or less what keybase [1] is.

[1] https://keybase.io/

pjbrunet 11 years ago |

Back in the Myspace era, I was bored and created an easy encoder-decoder for people to play with. It worked with Twitter, Facebook and Myspace (cut-paste your encoded text) because it only used basic characters. As you can't see in this animation, I later added random spaces and punctuation to the encoded text so that theoretically it would be harder for social networks to detect and block. The text was encoded in Javascript as you typed, which I thought was cool :-)

You can see it here as a GIF animation http://pjbrunet.com/friends-secret-messages.gif The decoder was just as easy, another pink box under the encoder. Obviously a pro could crack the code but that wasn't the point.

It was free. I advertised it to hundreds of thousands of people at the top of my blog which was 99% social media users and many of them were interested in privacy related topics as I could see from the Google queries. Looking at the CTR on that banner (asking people to try it) I concluded nobody cared. I was obviously targeting people who weren't tech savvy. I had some friends try it, they said they felt like James Bond ;-) That particular app had no traction, but my "pipe letter generator" did much better.

  ╔╔╗════╔╗═╔╗═════╔╗═══════╔╗══════════════════╔═╗╗
  ║║╚╗╔═╗║║═║║═╔═╗═║╚╗╔═╗╔═╗║╠╗╔═╗╔═╗═╔═╗╔═╗╔╦╦╗║═╣║
  ║║║║║╚╣║╚╗║╚╗║║║═║║║║╬║║═╣║╦╣║╚╣║╔╝═║║║║╚╣║║║║╠═║║
  ║╚╩╝╚═╝╚═╝╚═╝╚═╝═╚╩╝╚╩╝╚═╝╚╩╝╚═╝╚╝══╚╩╝╚═╝╚══╝╚═╝║
  ╚════════════════════════════════════════════════╝

lmm 11 years ago | |

I don't think anyone cares or should care about easy-to-break encryption. Encoding and decoding your messages has a cost, there needs to be a benefit beyond "looking cool".

pjbrunet 11 years ago | | |

I have to agree, but I was looking to limit the "cost" by making it easy and fun. I could see the demographics, most of them had time to kill. And with young people, you never know what will be cool, fashionable or viral. Easy-to-break is subjective too. Sibling, parent, teacher, advertiser, somebody looking over your shoulder? They couldn't break it. I think every generation has something like this, a Cracker Jack decoder ring, passing notes in class, some 1337 letter generator.

dimino 11 years ago |

What if Google validated PGP signatures for you from trusted, popular certs?

They'd have Facebook's pubkey on file, and -- transparent to you -- would create something analogous to my browser's lock icon in their email browser. Any time you got an email from Facebook, it'd say "Verified Sender".

Heck, couldn't we tie mail from Facebook back to their domain cert given to them by their CA? If it says @facebook.com, and it's passes verification from the cert on facebook.com, then it's actually from Facebook, right?

bbrazil 11 years ago | |

This has been done for some time already via DKIM and DMARC, which anyone can configure.

https://support.google.com/a/answer/174124 https://support.google.com/a/answer/2466580

eitally 11 years ago | | |

Thanks for noting this. A lot of discussion about email encryption and security is clearly from the consumer POV, and most people seem to be unaware of things enterprises already do (using commonly available tools & settings) to secure email. Not that it replaces message encryption via S/MIME or PGP, but companies like https://www.mailvelope.com/ and https://www.virtru.com are trying to help with that.

excel2flow 11 years ago |

Btw, does PGP support triple wrapping to prevent surreptitious forwarding? (S/MIME does - https://www.ietf.org/rfc/rfc2634.txt)

I really don't understand why it has been chosen over S/MIME. Maybe they gave the money to that german guy who wrote it and now they don't want them to be completely wasted :)

lmm 11 years ago | |

S/MIME has very little adoption - the kind of people who care about encrypting their email are usually the same kind of people who don't trust the CA system.

rmoriz 11 years ago | | |

That's not true: https://gist.github.com/rmoriz/5945400

CaptainZapp 11 years ago | |

Despite his German sounding name, I can assure you that Phil Zimmermann, the creator of PGP, is very much an American.

marktam264 11 years ago | | |

I think he meant GPG. http://en.m.wikipedia.org/wiki/Werner_Koch

escap 11 years ago | | |

He meant Werner Koch, the guy who is maintaining gnupg A few months ago, he asked again for donation, this time he got "good media exposure" and got funded. cf https://news.ycombinator.com/item?id=9011138

Facebook pledged to donate $50,000 a year to Koch’s project.

leejoramo 11 years ago |

Following Facebook's story on PGP, I see I had missed that Facebook directly supported Tor since last fall. https://www.facebook.com/notes/protect-the-graph/making-conn...

hstrauss 11 years ago |

I think the nicest part of this is that account recovery e-mails are encrypted. I wish we'd see more of this.

While I'm cautious about facebook in general, it is (in essence) a repository for public data. A public key falls into that category, so they gain nothing more than the association of user and key. And in return, the PRISM databank has more superbly useless information to store and eventually 'collect' for 1EF communication.

And I gain immunity from account hijacking unless I mess up Key Management.

lmm 11 years ago |

Has anyone got an encrypted email from facebook yet? I uploaded my key and ticked the box, but the last notification I got was still in the clear.

Joeboy 11 years ago | |

Yeah, I immediately-ish got an encrypted email asking me to confirm that I really wanted my notifications encrypted, and after I clicked the link I started getting encrypted notifications. Maybe check your spam?

sweis 11 years ago | |

Hi. Someone else commented, but you should have received an encrypted verification email with a link. We don't want to start sending you encrypted notifications until we confirm you're actually able to read them.

If you click that verification link, you'll receive a web notification that it's enabled should start receiving encrypted notifications.

Check your spam folder in case your mail provider's or client's spam filter is mislabeling it.

If you don't see it, try unchecking and rechecking the opt-in box, which should trigger a new verification email. (We've had a feature request for a "Resend" button".)

golemotron 11 years ago |

The easy answer is that they knew Apple was going to come out strong for encryption in the past few days and wanted to do a "me too."

leejoramo 11 years ago | |

Now if Apple does announce PGP/GPG support built into Mail in OS X and iOS, that would make this much more interesting.

I wonder if MS has made GPG support any easier in Outlook. Last I looked into it a year or two ago, it was hard to integrate unless you paid for the official PGP plug-in.

evgen 11 years ago | |

Given that one event involves coding, testing, and real deployment while the other is Tim Cook giving a speech where he spins another tale of "in the future..." BS that is in no way supported by anything real yet, I think you have the order backwards here.

coldpie 11 years ago | |

I'm totally OK with companies "me too"ing this particular feature.

anthony_barker 11 years ago |

Private public keys + verification gives way to lots of uses...

Payments (bitcoin style currencies), banking, document signitures, and single sign-on?

marcosdumay 11 years ago | |

Beware of turning Facebook into the general propose CA of web services.

rmoriz 11 years ago |

I wish they had opted to use S/MIME, because of the wide support in MUA and because it's relatively easy use even for non geeks.

Some time ago I started collecting support of S/MIME in products and companies: https://gist.github.com/rmoriz/5945400

thomasahle 11 years ago |

Regarding making this work with GMail, Google still has their End-to-End GPG plugin for Chrome+GMail: https://github.com/google/end-to-end

jaysoncena 11 years ago |

I like the idea of linking certificates to facebook accounts