Category Archives: Encryption
Used by only a few nerds, Facebook kills PGP-encrypted emails – TechCrunch
Image Credits: Bryce Durbin / TechCrunch
In 2015, as part of the wave of encrypting all the things on the internet, encouraged by the Edward Snowden revelations, Facebook announced that it would allow users to receive encrypted emails from the company.
Even at the time, this was a feature for the paranoid users. By turning on the feature, all emails sent from Facebook mostly notifications of likes and private messages to the users who opted-in would be encrypted with the decades-old technology called Pretty Good Privacy, or PGP.
Eight years later, Facebook is killing the feature due to low usage, according to the company. The feature was deprecated Tuesday.
Facebook declined to specify exactly how many users were still using the encrypted email feature. It is not hard to believe that practically nobody was using it. And as much as I love encryption, killing this feature makes a lot of sense.
First of all, you can switch off email notifications entirely for the simple reason that you can see those notifications in Facebooks app or in the browsers. Why would you want to get notified twice that your friend tagged you without asking for permission in that party photo where you are drunk?
For example, I used the email encryption feature at the time, but I also later switched off email notifications, so that feature was useless to me.
Also, who the hell uses PGP in the year of our lord 2023? Even the inventor of PGP, the revered cryptographer Phil Zimmermann, said he wasnt using PGP back in 2015.
The irony is not lost on me, Zimmerman told me in an email at the time.
Zimmermann said that the main reason he wasnt using PGP is that he couldnt run the necessary encryption software on his MacBook, since Symantec bought PGP in 2010 to incorporate the technology into its own products. Zimmerman also said there was no version of PGP ever ran on an iOS device. (It is worth noting that you can encrypt emails and files on Macs using GPG Tools, which served as PGPs de facto replacement after the Symantec acquisition if you like to inflict that kind of pain on yourself.)
I still use PGP very occasionally. If you want to annoy me, you can use my public PGP key to send me an encrypted message, which would be so much easier to read and respond to if you sent it to me on Signal or WhatsApp instead.
Rest in peace, Facebook email encryption. You wont really be missed.
Originally posted here:
Used by only a few nerds, Facebook kills PGP-encrypted emails - TechCrunch
Meta Brings End-to-End Encryption to All Messenger Chats and Calls – Times Now
Meta has announced that end-to-end encryption (E2EE) will be implemented across all chats and calls on both the Messenger app and the Facebook platform. This move represents a substantial change towards putting user privacy and security first.
Data is protected by E2EE technology since it is only readable by the sender and recipient. This is accomplished by encrypting the data on the sender's device with a unique key, rendering it unreadable to anyone intercepting it, including Meta.
Previously, E2EE was only available through Messenger's optional "Secret Conversations" function. It is now activated by default for all users, adding an extra degree of protection to their conversations.
"With E2EE, you can be confident that your messages and calls are protected from prying eyes," Meta wrote in a statement. "Nobody, including Meta, can see or hear your conversations unless you choose to report them."
Read Full Article
Meta has also announced Labyrinth, a new encrypted storage system designed to securely store E2EE messages and media on its servers. This assures that even if Meta's servers are compromised, the content of your messages will be safe.
Messenger's E2EE implementation is based on the open-source Signal protocol, which is known for its excellent security features. Meta has also created a browser extension called Code Verify for Instagram, WhatsApp, and Facebook users on web browsers. This tool checks the integrity of the JavaScript libraries used by these services to ensure they haven't been tampered with, putting E2EE at risk.
Meta has released two new features to improve user experience while also improving security: the ability to amend sent messages within 15 minutes and "disappearing messages" that automatically vanish after 24 hours.
While E2EE for Messenger group messaging is still being tested, it is likely to be available in future releases.
Overall, Meta's choice to make E2EE the default option for Messenger and Facebook shows a strong dedication to customer privacy. Users that desire safe communication channels and peace of mind in their online dealings are likely to embrace this decision.
See the original post:
Meta Brings End-to-End Encryption to All Messenger Chats and Calls - Times Now
Facebook Messenger gets end-to-end encryption by default and a slew of new features – GSMArena.com news – GSMArena.com
07 December 2023
Meta announced a slew of new features coming to Facebook Messenger and in case you are not seeing the changes yet, it's probably a staged rollout, so wait for a couple of days. Perhaps the most notable change is the end-to-end encryption by default.
From now on, all your private messages are encrypted and only you and your recipient can read those messages. That's a big step in the right direction, as most competing messengers, not just the privacy-oriented ones, are already offering end-to-end encryption.
In addition to the encryption, you can now edit messages (a long-awaited feature), send disappearing messages, hide your read receipt, so people can't see when you've read their message and there are some improvements to voice messaging. For instance, you can listen at 1.5x or 2x speed and continue listening to messages where you left off last time. There's a catch with the message editing, though - you can only do so with messages within 15 minutes of sending.
Photo and video quality get a boost and Meta is now testing HD photos and videos with a small group of users before making the changes worldwide.
Source
Original post:
Facebook Messenger gets end-to-end encryption by default and a slew of new features - GSMArena.com news - GSMArena.com
Meta begins rolling out E2E encryption on Messenger chats and calls – Neowin
Metas Messenger is one of the worlds most common ways to send messages with contacts, now the company has said it will roll out end-to-end (E2E) encryption for all personal chats and calls on Messenger and Facebook.
To be clear, encryption has been available on these platforms for a while but this latest news means the feature is switched on by default for personal messages and calls. Under the new scheme, messages that you send are protected from the moment they leave your device to the moment they reach your contacts device, preventing any middlemen, including Meta, from seeing what you said.
In the past when messaging clients had or added encryption, it sometimes meant a more restrictive experience in terms of features. With this launch, Meta said that users will retain familiar features like themes and custom reactions but will also get a bunch of new features too including edited and disappearing messages, read receipts control, improved photo and video sending, and improved voice messaging.
With message editing, Meta is striking a balance. You will only be able to edit messages for 15 minutes after sending them and if you want to report someones original message before they edited it then Meta will be able to read the message edit history.
With disappearing messages, they will now last 24 hours after being sent and the chat interface has been updated to inform users that the messages will disappear. As for read receipts control, youll be able to decide if you want to let others see that youve read their messages. This will reduce the pressure to respond to people right away if you dont feel like it.
When you get the update, youll also benefit from higher image quality and improved responding or reacting to any photo or video in a collection. Meta said its also testing HD media and file sharing improvements with some users and plans to scale this in the coming months.
Finally, Meta said that voice messaging is the fastest growing messaging format today and with this update youll be able to listen at 1.5x and 2x speeds as well as begin listening where you left so you can pick up again if you have to leave the app.
The roll out will take several months until everyone gets it but when you do, youll need to set up a recovery method, such as a pin, to restore your messages if you lose, change, or add a device.
Read more here:
Meta begins rolling out E2E encryption on Messenger chats and calls - Neowin
What does end-to-end encryption on Facebook and Messenger mean for users? – The National
Meta Platforms has said end-to-end encryption for personal chats on its flagship Facebook and Messenger applications is now activated by default, boosting privacy and security on two of the biggest social media platforms in the world.
The move offers better privacy control to users. Combined, Facebook and Messenger have more than four billion users (3.03 billion and 1.04 billion, respectively), according to Statista data.
We take our responsibility to protect your messages seriously and were thrilled that after years of investment and testing, were able to launch a safer, more secure and private service, Loredana Crisan, head of Messenger, wrote in a blog post on Thursday.
She also said the upgrades to Messenger are the biggest set of improvements since the app was launched in 2011.
End-to-end encryption is, in simplest terms, a system in which only those communicating with each other can see the messages being sent. For example, if you're sending messages to your mother, then only the two of you can see those messages.
E2EE, as it is also referred to, uses an algorithm that transforms standard text characters into an unreadable format. If you've explored folders on iPhone backups, then you have an idea what this looks like.
It uses encryption keys to scramble data so that only authorised users can read it.
The origins of E2EE stretch back to the 1970s, but it gained attention with the emergence of WhatsApp, which touted the key privacy feature. In 2014, Meta, then known as Facebook, bought WhatsApp for $19 billion.
The most obvious reason is that it guarantees the security and privacy of content being shared between users.
But this isn't only limited to regular users: businesses can also largely benefit from E2EE, as it can protect sensitive data and information, such as financial and legal documents.
Failure to secure private data could result in damages to enterprise businesses and their customers, according to IBM.
The global average cost for a data breach in 2022 was $4.35 million, up from $4.24 million the previous year, according to the latest edition of IBM's Cost of a Data Breach report.
Messenger had encryption in place from 2016, but it was an opt-in feature, meaning users had to manually activate it through settings. Voice and video calls have been encrypted since 2019.
The company had previously planned to make encryption a default feature in 2022, but delayed it amid warnings from child safety campaigners that it might prevent Meta from detecting child abuse on the platform.
California-based Meta took its time to get this right, having needed to rebuild Messenger features from the ground up, Ms Crisan said.
Our engineers, cryptographers, designers, policy experts and product managers have worked tirelessly, she said.
Aside from E2EE to boost security and privacy, Meta has also introduced upgrades to boost engagement.
Users can now edit messages for up to 15 minutes after they've been sent. If you want to report abuse on an edited message, you can still file a report to Meta as they will be able to see the previous versions of the edited message.
Meta has also said disappearing messages, similar to those popularised by Snapchat, now last for 24 hours after being sent. The interface for this has also been updated, which will help people be confident that their messages stay secure and wont stick around forever.
Additionally, the company updated its read receipt controls, letting users decide if they want others to see when they have read messages.
More controls have been added for photos and videos, including upgrading image quality.
Voice messages, meanwhile, can now be played at speeds of 1.5x or 2x, and users can continue listening to a message from where they left off or when navigating away from the chat or app.
Updated: December 07, 2023, 8:45 AM
See the original post:
What does end-to-end encryption on Facebook and Messenger mean for users? - The National
Meta to make Messenger messages encrypted automatically – Verdict
Meta announced on Wednesday (6 December) that all personal calls and chats on Facebook and Messenger will be subject to end-to-end encryption (E2EE) by default.
Encrypted messaging, where the content of the message is only accessible to the sender and recipient, is currently offered by messaging services WhatsApp, iMessage and Signal.
In a blog post, Loredana Crisan, vice-president of Messenger, said: Nobody, including Meta, can see whats sent or said, unless you choose to report a message to us.
The implementation of encryption across Facebook and Messenger will be a gradual process, with an unspecified timeline mentioned, according to the blog post.
While Messenger users have had the option to opt-in for end-to-end encryption since 2016, the default encryption for all personal calls and messages represents a substantial change.
Meta CEO Mark Zuckerberg celebrated the achievement in a Facebook post on Wednesday.
After years of work rebuilding Messenger, weve updated the app with default end-to-end encryption for all personal calls and messages, Zuckerberg said.
In 2019, Zuckerberg committed to implementing encryption technology across all private communications within the companys suite of apps, emphasising a shift towards private, secure digital interactions.
This announcement by Meta is expected to contribute to the ongoing discourse on privacy and law enforcements investigative capabilities.
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Your download email will arrive shortly
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
WhatsApp and Signal recently took a stand against potential legislative moves in the UK that could weaken encryption claiming they would rather be blocked than have encryption weakened.
The Online Safety Bill (OSB),a new UK law aimedat ensuring social media companies are held responsible for user safety, was passed in September after almost six years.
The new law means social media companies will need to work harder to protect children from inappropriate content, as well as removing all illegal content.
WhatsApp, which specialises in encrypted messaging, threatened to refuse to comply with guidelines that would force it to examine the contents of messages for child abuse material.
In June, more than 80 national and international civil society organisations, academics and cyber experts signed an open letter over the serious threat to private and encrypted messaging posed by the OSB.
Give your business an edge with our leading industry insights.
Read the original here:
Meta to make Messenger messages encrypted automatically - Verdict
The Quantum Computing Threat to Encryption and Cybersecurity – Medium
Photo by Fractal Hassan on Unsplash
Quantum computing is an incredibly promising innovation but it also jeopardizes current data protection methods. This emerging field requires an urgent collaborative response to safeguard privacy.
Quantum computers leverage quantum mechanics principles like superposition and entanglement to perform calculations exponentially faster than regular machines for certain tasks.
Through parallel computation on a massive scale, they hold huge promise for challenges from chemical simulations to machine learning.
Global tech giants like IBM and emerging startups have pioneered early but extremely powerful prototypes. However, unlocking the immense potential of these machines also necessitates upgrading crucial cybersecurity foundations built in a pre-quantum age.
Encryption protocols most of the digital world relies on remain dangerously exposed. As quantum hardware continues rapid advances, failure to future-proof security risks compromising privacy on an unprecedented scale.
A world with advanced quantum computers puts all current encrypted data at risk of interception and misuse. No existing encryption method would remain reliably secure.
Pretty much all sensitive data transmitted online - from financial records to government secrets and personal emails - depends on mathematical encryption techniques to prevent interception.
The most common public key encryption schemes used today like RSA, ECC and Diffie-Hellman base their security on the extreme difficulty for regular computers to factor very large prime numbers. This allows easy encryption by multiplying two large primes but makes decryption essentially impossible through brute computational force.
However, quantum computers can run algorithms like Shor's to quickly factor these large numbers and break the encryption. Where even the most advanced supercomputer would take millennia, a powerful enough quantum computer could unravel the security on such data in minutes.
Read the original post:
The Quantum Computing Threat to Encryption and Cybersecurity - Medium
AI and Quantum Computing Threaten Encryption and Data Security – Security Boulevard
As the business world continues to find innovative ways to apply AI to accelerate growth and streamline operations, a similar trajectory of inventive thinking is emerging in the cyberthreat landscape. While only theoretical at this juncture, one of the big concerns about AI, when combined with quantum computing, is that there is a possibility that what is encrypted at present could be decrypted in the future. This is enough of a security concern to give pause to even the most experienced technologists. So, how are AI advancements, including generative AI, jeopardizing traditional data security techniques such as encryption and how can emerging new risks be mitigated?
Encryption is a foundational element of data security, so the potential impacts of AI should be considered carefully. Overall, the unique attributes of AI, and particularly those of generative AI, have the potential to significantly improve the development of encryption algorithms themselves, the management of encryption keys, the control of access and administrative rights, etc. Due to its generative nature, generative AI can learn, adapt and ultimately produce net new outputs, raising the bar far above rigidly determined preset algorithms. What this translates to are exciting positive impacts to help security researchers, developers and operators to benefit from a new ally in their work.
At the same time, there are new risks because any powerful new technology can be used to benefit attackers. Malicious actors could push the currently established boundaries of data security by circumventing existing security controls, disrupting the proper management of keys, searching for ways to steal keys and credentials and more. For this reason, quantum computing (aided by generative AI) poses a future threat to current encryption algorithms, as the accelerated computing capabilities could, in theory, allow quantum tools to break the encryption within a reasonable amount of time (e.g., months or even moments, rather than centuries).
Since generative AI is likely to ramp up the capabilities of attackers and defenders, this, in turn, may lead to (or accelerate an already existing) arms race for more powerful AI to remain competitive and gain advantages.
As the evolution of AI produces both positive and negative impacts for cybersecurity in general, IT teams must start now to seek ways to reinforce traditional data security strategies (like encryption) to avoid unmanageable problems down the road. We are already seeing efforts to manage these challenges in government through public policy. While its unlikely that we will see new legislation in the next year, we are seeing progress in this area with the presidents executive order on safe, secure and trustworthy AI. The EO is helping to further define AI safety and security protocols by leveraging the power and resources of the executive branch departments, such as homeland security, defense, energy, commerce, etc. One powerful tool the executive branch has is its procurement policies as the largest buyer of goods and services on the planet, the federal government can profoundly influence the market, including technology and safety standards.
Tech ecosystem players are also turning their attention to well-established, authoritative, independent sources, such as NIST, the Center for Internet Security, ISO and IEEE. As new generative AI-led security challenges arise, these organizations, which produce and maintain operational and technical best practices based on the input of a wide variety of industry, government and academic experts, will develop guidelines to address real-world scenarios. We will also see best practices updated in specific industry tools as vendors, manufacturers, system integrators, industry analysts and third-party testing services glean new insights through practical, real-world experience with generative AI.
As AI practices are refined worldwide, enterprises will begin to apply these new guidelines and improve their protection against cybersecurity risks, which includes taking steps to advance post-quantum computing algorithms to future-proof encryption. Enterprises will be able to identify where AI could be used to fortify weak areas, mitigate vulnerabilities and detect and respond to attacks in real-time.
As we learn more about the interplay of AI with areas such as quantum computing and the credible threat this poses to traditional data security measures like encryption, limiting the data attack surface becomes a top priority.
Typically, the data attack surface is defined as any part of the organization, including websites, applications, email accounts and human interactions that could be an avenue of attack for malicious attackers. AI could be very impactful in reducing the data attack surface by enhancing the data management process, particularly in data discovery, during which it could find sensitive data that may be vulnerable or that may no longer be needed. Furthermore, AI can be effective during data classification by determining the nature of the data and how it should be classified per organizational policy, thus applying controls immediately. This is also the case during data sanitization, by ensuring that sensitive and/or ROT data is adequately erased (to standard), verified and recorded for inspection and audit purposes. Leveraging these approaches to minimize the attack surface will help reduce the information that bad actors could access presently and potentially be able to decrypt in the future.
Overall, the effect that AI has already had on business is visible in many areas. While only time will tell what the future holds for the cybersecurity landscape, it is worth taking a deeper look now at optimizing AI for improved efficacy and efficiency of present-day and future security controls and operations.
Recent Articles By Author
Read more from the original source:
AI and Quantum Computing Threaten Encryption and Data Security - Security Boulevard
NCA response to Meta’s rollout of end-to-end-encryption – National Crime Agency
James Babbage, Director General for Threats at the National Crime Agency, said:
It is hugely disappointing that Meta is choosing to roll out end-to-end encryption on Facebook Messenger. They have an important responsibility to keep children safe on their platform and sadly, this will no longer be possible.
Today our role in protecting children from sexual abuse and exploitation just got harder.
For years Meta has supported law enforcement by identifying and reporting instances of child sexual abuse to the National Center for Missing and Exploited Children in the US, as they are obliged to do under US law.
NCA officers and our partners in policing work day in day out to analyse these reports and progress investigations. Together, we are safeguarding 1,200 children and arresting around 800 suspects every single month.
Unfortunately, this important work is now at risk. As a result of Metas design choices, the company will no longer be able to see the offending occurring on their messaging platform, and law enforcement will no longer be able to obtain this evidence from them.
This problem wont go away; if anything it will likely get worse. Offenders will still use Facebook Messenger to send illegal material, and will use the vast quantity of data shared on the platform about children to select and groom future victims.
The alternative safety measures developed by the company relying on metadata alone will rarely, if ever, produce sufficient evidence for a search warrant. This means that in practice, the volumes will be so great that they are likely to be of very little value.
The onus should not be entirely on children to report abuse.
The NCA, with our partners in the UK and overseas, will continue to do everything in our power, to safeguard children and identify offenders.
Notes to editors:
Read the original here:
NCA response to Meta's rollout of end-to-end-encryption - National Crime Agency
Facebook Messenger to get end-to-end encryption by default – The Express Tribune
Meta Platform is finally rolling out end-to-end encryption for Messenger after years of promises and tests. According to Mark Zuckerberg, personal chats and calls will get default end-to-end encryption, except group chats where it will remain optional.
End-to-end encryption has become a vital security layer, ensuring that the company or any third-party can access the content of the chat.
This has taken years to deliver because weve taken our time to get this right. Our engineers, cryptographers, designers, policy experts, and product managers have worked tirelessly to rebuild Messenger features from the ground up, Metas head of Messenger, Loredana Crisan, said in a blog post.
Meta explained the delay in introducing the security feature was because the company had to build some features from the ground up to incooperate end-to-end encryption. In August, the company promised Instagram DMs, the same feature right after Messenger.
In its new update, Messenger is also getting a feature to edit sent messages up to 15 minutes after sending; speed control for voice messages to play those audio clips at 1.5x or 2x; new photo and video layouts; and a new interface for disappearing messages. Meta is also working on sending HD images and videos on the platform.
Visit link:
Facebook Messenger to get end-to-end encryption by default - The Express Tribune