Hacker News new | past | comments | ask | show | jobs | submit

E2E encrypted messaging on Instagram will no longer be supported after 8 May

https://help.instagram.com/491565145294150
Isn't this actually improving safety by openly admitting how things always were in practice?

Any e2e encryption provided by the same entity who fully controls both the blackbox clients, and the server in between, is just a security theatre that they can selectively bypass anytime with very little risk of detection. Not really much better than simple client to server encryption.

Truly safe e2e requires open source client provided by a trusted entity who is as much as possible independent from the one who provides the untrusted transport layer. Eg how pgp email works.

loading story #47367354
one thing to consider is how just the optics of major players using e2e was an overall benefit.

people who otherwise would have gone their entire lives without ever hearing about encryption were exposed to the term and the marketing convinced them that encryption and privacy was a valuable thing, even if they didnt fully understand the mechanisms or why e2e might not necessarily be very effective in specific circumstances.

later, when presented between option a and option b, where one has encryption and the other doesnt, they are more likely to choose the one with it ("well, if instagram and facebook use it and say it is good...")

If someone's given the choice between say Instagram and IRC, and chooses Instagram because they heard it has E2EE, that's a loss.
perfect is the enemy of good, etc etc.

between signal and plain text, it is easier to convince friends to use signal if they see positive marketing about encryption on other popular apps they use. it is easier to convince them to encrypt their backups before uploading them to their google drive. hell, its just a good conversation starter to introduce encryption/online privacy to people that never really think about it. that type of thing.

those same friends are not going to use irc regardless. not really a loss if it was never even on the table.

{"deleted":true,"id":47366806,"parent":47366785,"time":1773420713,"type":"comment"}
loading story #47367627
E2E encryption lets Meta turn down government subpoenas because they can say they truly don't have access to the unencrypted data.

I can't say I really mind this change by Meta that much overall though. Anyone who's serious about privacy probably knew better than to pick "Instagram chat" as their secure channel. And on the other hand having the chats available helps protect minors.

So apparently this was opt-in, much like Telegram's OTR chat feature, and thus completely different than WhatsApp where it has always been default. Not a good look regardless, but the few who went into chat settings for a specific person to turn this on in the first place will likely just switch to WhatsApp or another app rather than continue without it.
loading story #47365909
It could be a move to have parity with TikTok, where they claim it’s for safety reasons. I’ve been seeing advertisements for Instagram touting their child/teen protection features. Seems like they’re really trying to beat the allegations that Instagram is bad for children’s health.

https://news.ycombinator.com/item?id=47241817

loading story #47364678
loading story #47365693
loading story #47365865
loading story #47365260
loading story #47365602
loading story #47364710
loading story #47364738
When Meta starting introducing E2E messaging it was a huge push. I wonder why they're doing away with it.
loading story #47364954
loading story #47366021
loading story #47364573
Is this legitimate? It's so incoherent to see this blurb at the top saying it's being retired while everything underneath is pitching the value of e2e.
On the other hand Messenger has moved to only supporting e2ee chats, wonder why the difference.
loading story #47365576
loading story #47367140
There's a general trend right now against privacy and in a more general sense against freedom. More and more companies are on board with it. I'm not sure if anyone in HN has any useful advice in this regard. I feel like I don't know what to do about the internet for the next 5-10 years. Does this particular measure matter very much? No, but it's another brick in the wall.
loading story #47366327
loading story #47366968
loading story #47365960
loading story #47366107
loading story #47367109
loading story #47366186
loading story #47366545
loading story #47366620
loading story #47366289
E2EE on Instagram was never real, trustable E2EE. No open-source client, no way to verify that private key is never sent to server, and encryption of a key with a low-entropy PIN is effectively plaintext.
loading story #47365944
loading story #47366420
loading story #47365957
loading story #47365998
i don't understand this doomer mentality regarding the internet.

internet is a service that you choose what to engage and how. don't like a platform? find another, build it or stop using it altogether.

personally, i find these things really great has it helps nudge people into the more decentralized web. a few years ago those who were pushing for privacy respecting apps and platforms were deemed too paranoid.

Network effects will keep a person on a platform until a critical mass of their social circle decide to leave all at once. I'm no expert, but I suspect that that critical mass is pretty high, maybe more than 50% of a person's circle. So it's not exactly vanilla free-market competition. Entrenched players have a pretty big advantage.
loading story #47366110
loading story #47366528
loading story #47366321
Socials are caught in the innovator's dilemma.

Given the dependence our society now has on the internet, it's bonkers to me that more VCs aren't rethinking their investment strategy. Privacy is not some niche concern anymore, check out the response to Flock for example.

The only reason I can think of for this change is governmental pressure. I don’t see how it benefits the platform itself (nor its users).
loading story #47366935
loading story #47366800
loading story #47367446
the timeline for all of this is not a coincidence. meta spent millions lobbying for age verification laws that require content scanning. hard to scan content that's encrypted.
This feature has never been available to me- it just threw an error each time. Wonder how far it actually got rolled out?
Did they give a reason why are they doing this?
Never rely on a platform used by the masses to perform E2EE. It is far too easy to strip away E2EE for targeted users without their knowledge as they maintain the server and client code. This advise is to protect from corporations gobbling up and ultimately leaking sensitive data. Spooks can target the device itself via debug access for nation state level threats.

Consider instead using a code word or phrase to move sensitive conversations to something self hosted such as jabber using OMEMO XEP-0384 and XEP-0373 OpenPGP for XMPP and SASL SCRAM. OMEMO is an implementation of the Signal protocol on top of the XMPP protocol.

e.g. "_Expletive_! I stubbed my toe!" other-person: "lol geezer watch where you are walking." conversation quietly and temporarily moves to the pre-shared self-hosted Jabber server. Temporarily because going dark can draw attention. Feed the big chat platform boring garbage and misdirection.

loading story #47366116
loading story #47366261
I don't use IG although they dearly want me to, giving me a popup every time I visit, but let me talk about FB for a second (and btw FB wanted to enable cross-platform messaging on the platforms they own - Meta - which seems anti-trust-y) - when they introduced encryption on FB, they made it mandatory. They opted everyone in, and it broke Messenger. If you delete cookies you might also delete messages. Isn't that convenient?
just waiting on whatsapp to rug pull as well & then bye bye privacy & meta from my life
loading story #47365070
We all know what this means.
This could obviously tie to sending you more ads.

It could also tag people communicating about topics ig chat that it is actively suppressing.

They may be looking for an uproar to reverse the policy as so far, it's just words.

because they want to read your messages for training ai and for advertising
I wonder if this is the start of a trend or just a one-off?
loading story #47365773
loading story #47364705
Use this https://www.ricochetrefresh.net/ Chat and file transfer over tor
The USA is going full fascism. People keep laughing at it and only realize it when it's too late.
loading story #47364751
loading story #47365961
loading story #47365828
Wait, people trust communication via Instagram thinking they are secure?
loading story #47364910