Cloud Hosting

Meta Platforms has said end-to-end encryption for personal chats on its flagship Facebook and Messenger applications is now activated by default, boosting privacy and security on two of the biggest social media platforms in the world.

The move offers better privacy control to users. Combined, Facebook and Messenger have more than four billion users (3.03 billion and 1.04 billion, respectively), according to Statista data.

We take our responsibility to protect your messages seriously and were thrilled that after years of investment and testing, were able to launch a safer, more secure and private service, Loredana Crisan, head of Messenger, wrote in a blog post on Thursday.

She also said the upgrades to Messenger are the biggest set of improvements since the app was launched in 2011.

End-to-end encryption is, in simplest terms, a system in which only those communicating with each other can see the messages being sent. For example, if you're sending messages to your mother, then only the two of you can see those messages.

E2EE, as it is also referred to, uses an algorithm that transforms standard text characters into an unreadable format. If you've explored folders on iPhone backups, then you have an idea what this looks like.

It uses encryption keys to scramble data so that only authorised users can read it.

The origins of E2EE stretch back to the 1970s, but it gained attention with the emergence of WhatsApp, which touted the key privacy feature. In 2014, Meta, then known as Facebook, bought WhatsApp for $19 billion.

The most obvious reason is that it guarantees the security and privacy of content being shared between users.

But this isn't only limited to regular users: businesses can also largely benefit from E2EE, as it can protect sensitive data and information, such as financial and legal documents.

Failure to secure private data could result in damages to enterprise businesses and their customers, according to IBM.

The global average cost for a data breach in 2022 was $4.35 million, up from $4.24 million the previous year, according to the latest edition of IBM's Cost of a Data Breach report.

Messenger had encryption in place from 2016, but it was an opt-in feature, meaning users had to manually activate it through settings. Voice and video calls have been encrypted since 2019.

The company had previously planned to make encryption a default feature in 2022, but delayed it amid warnings from child safety campaigners that it might prevent Meta from detecting child abuse on the platform.

California-based Meta took its time to get this right, having needed to rebuild Messenger features from the ground up, Ms Crisan said.

Our engineers, cryptographers, designers, policy experts and product managers have worked tirelessly, she said.

Aside from E2EE to boost security and privacy, Meta has also introduced upgrades to boost engagement.

Users can now edit messages for up to 15 minutes after they've been sent. If you want to report abuse on an edited message, you can still file a report to Meta as they will be able to see the previous versions of the edited message.

Meta has also said disappearing messages, similar to those popularised by Snapchat, now last for 24 hours after being sent. The interface for this has also been updated, which will help people be confident that their messages stay secure and wont stick around forever.

Additionally, the company updated its read receipt controls, letting users decide if they want others to see when they have read messages.

More controls have been added for photos and videos, including upgrading image quality.

Voice messages, meanwhile, can now be played at speeds of 1.5x or 2x, and users can continue listening to a message from where they left off or when navigating away from the chat or app.

Updated: December 07, 2023, 8:45 AM

See the original post:
What does end-to-end encryption on Facebook and Messenger mean for users? - The National

As the business world continues to find innovative ways to apply AI to accelerate growth and streamline operations, a similar trajectory of inventive thinking is emerging in the cyberthreat landscape. While only theoretical at this juncture, one of the big concerns about AI, when combined with quantum computing, is that there is a possibility that what is encrypted at present could be decrypted in the future. This is enough of a security concern to give pause to even the most experienced technologists. So, how are AI advancements, including generative AI, jeopardizing traditional data security techniques such as encryption and how can emerging new risks be mitigated?

Encryption is a foundational element of data security, so the potential impacts of AI should be considered carefully. Overall, the unique attributes of AI, and particularly those of generative AI, have the potential to significantly improve the development of encryption algorithms themselves, the management of encryption keys, the control of access and administrative rights, etc. Due to its generative nature, generative AI can learn, adapt and ultimately produce net new outputs, raising the bar far above rigidly determined preset algorithms. What this translates to are exciting positive impacts to help security researchers, developers and operators to benefit from a new ally in their work.

At the same time, there are new risks because any powerful new technology can be used to benefit attackers. Malicious actors could push the currently established boundaries of data security by circumventing existing security controls, disrupting the proper management of keys, searching for ways to steal keys and credentials and more. For this reason, quantum computing (aided by generative AI) poses a future threat to current encryption algorithms, as the accelerated computing capabilities could, in theory, allow quantum tools to break the encryption within a reasonable amount of time (e.g., months or even moments, rather than centuries).

Since generative AI is likely to ramp up the capabilities of attackers and defenders, this, in turn, may lead to (or accelerate an already existing) arms race for more powerful AI to remain competitive and gain advantages.

As the evolution of AI produces both positive and negative impacts for cybersecurity in general, IT teams must start now to seek ways to reinforce traditional data security strategies (like encryption) to avoid unmanageable problems down the road. We are already seeing efforts to manage these challenges in government through public policy. While its unlikely that we will see new legislation in the next year, we are seeing progress in this area with the presidents executive order on safe, secure and trustworthy AI. The EO is helping to further define AI safety and security protocols by leveraging the power and resources of the executive branch departments, such as homeland security, defense, energy, commerce, etc. One powerful tool the executive branch has is its procurement policies as the largest buyer of goods and services on the planet, the federal government can profoundly influence the market, including technology and safety standards.

Tech ecosystem players are also turning their attention to well-established, authoritative, independent sources, such as NIST, the Center for Internet Security, ISO and IEEE. As new generative AI-led security challenges arise, these organizations, which produce and maintain operational and technical best practices based on the input of a wide variety of industry, government and academic experts, will develop guidelines to address real-world scenarios. We will also see best practices updated in specific industry tools as vendors, manufacturers, system integrators, industry analysts and third-party testing services glean new insights through practical, real-world experience with generative AI.

As AI practices are refined worldwide, enterprises will begin to apply these new guidelines and improve their protection against cybersecurity risks, which includes taking steps to advance post-quantum computing algorithms to future-proof encryption. Enterprises will be able to identify where AI could be used to fortify weak areas, mitigate vulnerabilities and detect and respond to attacks in real-time.

As we learn more about the interplay of AI with areas such as quantum computing and the credible threat this poses to traditional data security measures like encryption, limiting the data attack surface becomes a top priority.

Typically, the data attack surface is defined as any part of the organization, including websites, applications, email accounts and human interactions that could be an avenue of attack for malicious attackers. AI could be very impactful in reducing the data attack surface by enhancing the data management process, particularly in data discovery, during which it could find sensitive data that may be vulnerable or that may no longer be needed. Furthermore, AI can be effective during data classification by determining the nature of the data and how it should be classified per organizational policy, thus applying controls immediately. This is also the case during data sanitization, by ensuring that sensitive and/or ROT data is adequately erased (to standard), verified and recorded for inspection and audit purposes. Leveraging these approaches to minimize the attack surface will help reduce the information that bad actors could access presently and potentially be able to decrypt in the future.

Overall, the effect that AI has already had on business is visible in many areas. While only time will tell what the future holds for the cybersecurity landscape, it is worth taking a deeper look now at optimizing AI for improved efficacy and efficiency of present-day and future security controls and operations.

Recent Articles By Author

Read more from the original source:
AI and Quantum Computing Threaten Encryption and Data Security - Security Boulevard

James Babbage, Director General for Threats at the National Crime Agency, said:

It is hugely disappointing that Meta is choosing to roll out end-to-end encryption on Facebook Messenger. They have an important responsibility to keep children safe on their platform and sadly, this will no longer be possible.

Today our role in protecting children from sexual abuse and exploitation just got harder.

For years Meta has supported law enforcement by identifying and reporting instances of child sexual abuse to the National Center for Missing and Exploited Children in the US, as they are obliged to do under US law.

NCA officers and our partners in policing work day in day out to analyse these reports and progress investigations. Together, we are safeguarding 1,200 children and arresting around 800 suspects every single month.

Unfortunately, this important work is now at risk. As a result of Metas design choices, the company will no longer be able to see the offending occurring on their messaging platform, and law enforcement will no longer be able to obtain this evidence from them.

This problem wont go away; if anything it will likely get worse. Offenders will still use Facebook Messenger to send illegal material, and will use the vast quantity of data shared on the platform about children to select and groom future victims.

The alternative safety measures developed by the company relying on metadata alone will rarely, if ever, produce sufficient evidence for a search warrant. This means that in practice, the volumes will be so great that they are likely to be of very little value.

The onus should not be entirely on children to report abuse.

The NCA, with our partners in the UK and overseas, will continue to do everything in our power, to safeguard children and identify offenders.

Notes to editors:

Read the original here:
NCA response to Meta's rollout of end-to-end-encryption - National Crime Agency

Meta has just announced their biggest set of improvements to Messenger since it was first launched in 2011. Firstly, both Messenger and Facebook will now have end-to-end encryption (EE2E) by default for private chats and calls, which means no third party can pry into your private communicationnot even Meta itself. The importance of end-to-end encryption cannot be overstated, especially after the Sunbird-powered Nothing Chats botched their encryption.

Once updated to the latest version, users on Messenger will be asked to set up a PIN in case they need to recover messages on a new device later. The global rollout will take months to complete as the app has over a billion users, but Meta has yet to announce when the update will begin and how long it will take for it to be fully operational.

Source: Meta.According to Meta, EE2E has been in the app since 2016, but only as part of the Secret Conversations function. Company CEO Mark Zuckerberg noted the platform has begun working on bringing this feature as a regular function since 2019. Furthermore, as it moves forward with updating security, Meta said it also plans to rebuild Messenger features from the ground up.

In addition to a set of privacy and safety features, Messenger will also improve the image quality of photos and videos, as Meta is currently testing HD media sharing with a small test group before releasing it in the coming months. Additionally, the app will also be receiving other tools that are seemingly inspired by WhatsApp, namely the ability to edit already sent messages (for up to 15 minutes after sending), voice message playback outside the chat or app, read receipts control, and disappearing messages after 24 hours something made available to all chats as end-to-end encryption has become the default.

(Source: Meta, Engadget)

Follow us on Instagram, Facebook, Twitter or Telegram for more updates and breaking news.

Continued here:
Facebook Messenger Will Now Have End-To-End Encryption By Default - Lowyat.NET