2

Is it possible to prove that Facebook Messenger's end-to-end feature is actually device-device encryption and not device-facebook-device Facebook being the man in the middle?

4

There's no way to prove that unless you inspect every line of relevant source code involved. If you do have access to every line of code, then yes, you can prove to your satisfaction that you're dealing with end-to-end encryption.

However, since the code can be changed at will by Facebook, you'll have no way of knowing whether communication remains secure after your code inspection, or whether it was secure before you inspected the code.

So, unfortunately, the answer is that just like with much of the rest of our lives, you'll have to put some trust in what other people - Facebook, in this instance - tell you. You'll have to decide whether you want to invest that trust, or not.

Network monitoring

Your idea of monitoring network traffic gives you an indicator, but is by no means conclusive.

If Facebook wanted to secretly eavesdrop on your conversation, it wouldn't have to route the messenger protocol through it's own servers. The messenger could just record what you type and use a covert channel to send it to some harmless-looking server later on. The channel used to exfiltrate your messages could be fairly easy to detect (direct connection to the Facebook servers - but since it would be encrypted, you wouldn't know it was part of some other function of the messenger), something like fake DNS queries to a bogus DNS server, or any other harmless-looking form of network connection. If it was time-delayed, the chance that you'd catch it would be basically nil.

Also, even if the messenger DOES route traffic through it's own servers, this isn't a sign of wrong-doing at all. If you want messages to be held while the recipient is out of reach, and have them delivered once he comes online again, you must store them somewhere. End-to-end encryption doesn't mean the messages aren't stored somewhere; it just means that the messages can only be read by the originator and the recipient. So the messenger could do something very simple: It could encrypt every message twice: Once for the recipient, and once for Facebook. Then it would send both messages to Facebook servers, packaged to look like a single message, and you'd never know the difference.

So do they spy on you?

Note that I'm NOT saying Facebook is lying to you; in fact I believe they take end-to-end encryption seriously. If you don't believe in the inherent honesty of people or in Facebook's adherence to law, you might be more convinced by thinking about the public relations disaster that exposure would mean, and that Facebook, being locked in a fight for users with competitors, might not want to risk a significant percentage of users over something that offers them so little advantages. Because if you think about it, what would Facebook gain, exactly, from reading your messages? They already get something very valuable from your usage of Messenger: They know who you're communicating with, and they know how often, and when. This metadata might actually be more valuable that the content of the messages.

| improve this answer | |
  • How about monitoring the key exchange in wireshark, if only the two device's IPs are involved, it should be safe, if it is built on common protocols, e.g. GPG. I mean if I can find that there's absolutely no packets going through Facebook servers, it should be safe, right? – Rápli András Mar 16 '17 at 8:16
  • I updated my answer to discuss this. – Out of Band Mar 16 '17 at 9:09
  • 1
    I don't think, Facebook would profit out of reading these messages, but instead governments could force Facebook to do so. On the other hand, it's a good sign to me, that FB acquired WhatsApp, which allegedly implemented the same communication technology that Signal used. The background of my question is that I'm continuously looking for trustworthy encrypted communication channels for discussing sensitive topics with people who have zero IT knowledge. Signal compiled from source should be the good solution, but it's still circumstantial for others to use. – Rápli András Mar 16 '17 at 9:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.