What is end to end encryption?
Hi everyone. Leo. Notenboom
here for askleo.com.
There was a recent news story about how Facebook made available available
to government agencies the transcripts of a chat happening
between two people using Facebook Messenger.
I want to go over how that's possible and how something called endto end
encryption kind of protects you from that kind of thing.
I think a lot of people are confused as
to just how much is encrypted when we talk about encryption.
And they will often consider the word encryption to be enough.
It's not because Facebook Messenger is encrypted.
It's just not encrypted the way you think it is.
So, end to end encryption, honestly, the concept is super duper simple
when you are exchanging information with someone else remotely.
And I will use a generic messenger
application because we'll be talking about some specifics here in a minute.
But say you're chatting with someone on a messenger application of some sort.
End to end encryption means that when you send a message, it is encrypted before it
leaves your device in a way that can only be decrypted by the final recipient.
The person you're chatting with,
nobody else, can see the contents of your message.
It's encrypted from one end to the other.
That's why we call it end to end encryption.
What that means is, of course, that nobody in the middle can see what's going on.
When we think of messaging applications,
we typically think of messaging applications that are provided by some
third party service, be it Facebook or WhatsApp,
which is still Facebook or Signal or Telegram or those kinds of applications.
There's still a company, a service in the middle,
that is facilitating your communication with end to end encryption.
All that service does is hand off the encrypted blob from one person
to the other without being able to see what's inside.
That's not what happened with Facebook Messenger.
Facebook messenger apparently uses what I will call end to middle encryption.
So with end to middle, when you send a message,
your device encrypts, it, sends it to the service where it is decrypted.
Now, that conversation between you and the service is protected.
Nobody between you and the service can see the contents of your message.
Your ISP. Can't see it.
The network providers along the way can't see it.
It's just, it's encrypted.
But the service in the middle decrypts it because the only piece
of the communication path that is encrypted is between you and the service.
Now, the same is true for your recipient.
The only piece of their communication path
that is encrypted is between them and the service.
So your message encrypted on your side,
sent to the service, decrypted, is then reencrypted and sent to your
recipient, who then decrypts it and can read it.
But the important message here,
the important thing here is that in the middle,
that service you're using has decrypted and can see the contents of your message.
Apparently that's how Facebook messenger works.
Now, there are technical reasons that sometimes it's the preferred solution.
Don't get me wrong, I'm not necessarily faulting them.
And in there, I don't know if you want to call it their defense,
they do plan to move Facebook Messenger to true end to end encryption.
But here's the real takeaway.
You need to know what you're using if you're transmitting anything sensitive.
Because honestly, facebook doesn't care what you're talking about.
They really don't.
We've had this discussion many times in the past about older messaging systems,
and it always comes down to you're scared about the third party,
the service in the middle, doing something with your messages.
They don't care.
But if law enforcement might,
if the government might, then they can in some cases compel
Facebook or whatever third party to turn over whatever it is they have.
And that's what happened here with Facebook messenger.
The new story that I linked
to in the article that accompanies this video talks about exactly that.
There was a conversation across Facebook messenger.
The authorities got involved,
a court order was issued, and Facebook was compelled to turn over
the information that it was able to view in the middle.
Had end to end encryption been used, that would not have been possible.
Facebook would not have seen what was
in the middle, so would not have been able to turn over your conversation.
If anything, they could still be compelled to turn over the data.
But the data is this encrypted blob
that is unintelligible without the decryption keys.
So understanding what it is that you're
using becomes important when you're talking about sensitive information.
And to be clear, I talk about the service
and the authorities compelling the service to turn over information.
It's more than that.
Basically, anytime you're transmitting
sensitive information and you run the risk of being intercepted
in some way, maybe you live in a country with an authoritarian regime.
Maybe you live in a company that's
constantly snooping on what it is you're communicating.
Maybe you are talking about something that is controversial and sensitive.
Understand that end to end encryption is what's required to keep you safe,
to keep that information from falling into the hands of third parties.
So what's the solution?
Well, the solution of course, is and to end encryption.
The solution is for you to be aware
of what the technology you're using is actually using.
We now know that Facebook messenger right now does not use end to end encryption.
We do know that.
WhatsApp claims to use end to end encryption?
I say claims mostly because
WhatsApp is owned by Facebook, and that claim really depends on how much
you trust Facebook, and I know a lot of people don't.
I totally get that.
Personally, I think it's end encrypted.
I really do think that Facebook cannot see what I'm chatting on WhatsApp?
But there are other alternatives.
Telegram, signal, and others.
These are designed specifically to be endto end encrypted.
And one of the reasons that I feel confident using them is that these are
the technologies that embedded journalists use when they are in dangerous situations,
when they are in politically charged situations.
That's how they get their information out.
Now, there is one thing that I want
to talk about that is explicitly not a solution.
A VPN.
A VPN does not solve this problem.
A VPN solves a different problem.
A VPN encrypts only between your machine and the VPN service.
After the VPN service, as the message makes its way to Facebook
or to whatever intermediate service you're using, it's back in its unencrypted form.
VPNs are great for protecting you at Open,
WiFi, Hotspots, or other places where you don't trust the ISP or the government
that you happen to be in, but they do not provide EndToEnd encryption.
The tool you're using needs to be able to do that.
So the bottom line here is if privacy
truly matters, make sure you understand what technology is being used
by the software you use to communicate with others.
If it really matters, you want to make sure it's using end to end encryption.
Anything less puts you at risk,
as these people who used Facebook Messenger unfortunately found out.
Hopefully, that's helpful.
For updates, for comments, for links related to this topic,
pick and more, including the link to the original news
article that started this discussion, visit askleo.com/148038.
I'm Leo. Notenboom this is Askleo.com.
Thanks for watching.