Isn't this actually improving safety by openly admitting how things always were in practice?

Any e2e encryption provided by the same entity who fully controls both the blackbox clients, and the server in between, is just a security theatre that they can selectively bypass anytime with very little risk of detection. Not really much better than simple client to server encryption.

Truly safe e2e requires open source client provided by a trusted entity who is as much as possible independent from the one who provides the untrusted transport layer. Eg how pgp email works.

• john_strinlai

  last Friday at 4:24 PM

  one thing to consider is how just the optics of major players using e2e was an overall benefit.

  people who otherwise would have gone their entire lives without ever hearing about encryption were exposed to the term and the marketing convinced them that encryption and privacy was a valuable thing, even if they didnt fully understand the mechanisms or why e2e might not necessarily be very effective in specific circumstances.

  later, when presented between option a and option b, where one has encryption and the other doesnt, they are more likely to choose the one with it ("well, if instagram and facebook use it and say it is good...")

  • GoblinSlayer

    last Friday at 7:20 PM

    And Big Brother realized this optics was a mistake.

  • gzread

    last Friday at 4:50 PM

    If someone's given the choice between say Instagram and IRC, and chooses Instagram because they heard it has E2EE, that's a loss.

    • john_strinlai

      last Friday at 4:55 PM

      perfect is the enemy of good, etc etc.

      between signal and plain text, it is easier to convince friends to use signal if they see positive marketing about encryption on other popular apps they use. it is easier to convince them to encrypt their backups before uploading them to their google drive. hell, its just a good conversation starter to introduce encryption/online privacy to people that never really think about it. that type of thing.

      those same friends are not going to use irc regardless. not really a loss if it was never even on the table.

    • last Friday at 4:51 PM

  • inquirerGeneral

    yesterday at 5:00 AM

    [dead]

• iamthejuan

  last Friday at 5:41 PM

  This happened to my girlfriend and me twice on Messenger. On two consecutive nights, we heard a male voice with an American accent speaking as if he were talking to someone else, almost like they were conducting some kind of operation. It seemed as though he suddenly realized that we could hear him, after which the voice abruptly disappeared. The following night, it happened again, but this time the voice sounded like that of an African American woman. The situation was similar to the previous night. From that night, we have not used it to communicate and used Signal instead.

  • browsingonly

    last Friday at 10:10 PM

    I work on products that feature live monitoring capabilities. There's no connection to the monitoring side's microphone (or camera) — why would there be? I'm not sure why there would be for their products.

    Whatever the cause, it sure sounds like it was a strange and unnerving experience.

  • prox

    last Friday at 6:13 PM

    You mean like a voicecall on Messenger? That is creepy.

    • XorNot

      yesterday at 1:34 AM

      One time when I was in Hawaii I could swear there was a club playing dance music quite loudly somewhere a few blocks over: there was that muffled quality to it where I kept trying to pick out the song from inside my Airbnb.

      Walking outside (after asking my wife if she could hear it): silence. Trees rustling, normal noises.

      It was background noise. But inside the apartment that combination of different sounds was just right that it sounded like muffled music to me - but hence why I couldn't identify it, whatever was there was just me thinking I was hearing things.

      Draw ones own conclusions about the relative technical plausibility of the events described by the OP (how would digital packet based audio experience a glitch which is structured as though you'd tuned into another analog radio station? It wouldn't: that doesn't happen and it isn't even a failure mode).

      • yesterday at 3:15 AM

  • root_axis

    last Friday at 6:40 PM

    What do you imagine was going on here?

  • exe34

    last Friday at 10:50 PM

    did you check your carbon monoxide alarm batteries?

    • RobRivera

      yesterday at 12:32 AM

      I understand this reference.

• mnahkies

  last Friday at 6:54 PM

  I don't disagree, but I think there is a distinction between "everything is e2ee, but specific conversations may be MiTM without detection" and "nothing is e2ee and can be retrospectively inspected at will" that goes a little beyond security theatre - makes it more analogous to old fashioned wiretaps in my mind.

  Obviously it involves trust that it isn't actually "we say it's e2ee but actually we also MiTM every conversation"

  • londons_explore

    yesterday at 5:13 PM

    Even with closed source clients, MitMing every conversation would likely be detected by some academic soon enough - various people take memory dumps of clients etc and someone would flag it up soon enough.

• dgrin91

  last Friday at 7:59 PM

  One of the scary things is that not even this really works. Ignoring supply chain attacks, most people treat any client as effectively black box. When was the last time you read through the code of a messaging app? How do you know its safe? Maybe _you_ read through it, but 99% of people don't.

  • londons_explore

    yesterday at 5:15 PM

    And even if you did read through every line of code, it is super easy to hide a deliberate bug which entirely breaks encryption.

    Eg. The Debian random number generator bug.

• dhblumenfeld1

  last Friday at 9:55 PM

  wouldn't signal fall under this category (same entity control the client and server in between) but they have no way of peaking inside any envelopes?

  • hsbauauvhabzb

    last Friday at 11:06 PM

    Every e2e solution relies on trusting the application/tooling/crypto used. Open source is better than nothing, but is not a silver bullet for trust.

• chis

  last Friday at 5:14 PM

  E2E encryption lets Meta turn down government subpoenas because they can say they truly don't have access to the unencrypted data.

  I can't say I really mind this change by Meta that much overall though. Anyone who's serious about privacy probably knew better than to pick "Instagram chat" as their secure channel. And on the other hand having the chats available helps protect minors.

• JasonADrury

  yesterday at 6:02 PM

  >Any e2e encryption provided by the same entity who fully controls both the blackbox clients, and the server in between, is just a security theatre that they can selectively bypass anytime with very little risk of detection. Not really much better than simple client to server encryption.

  You are no more capable of spotting a deliberately concealed backdoor in a binary than in source code, there's simply no meaningful difference.

• Synaesthesia

  last Friday at 6:07 PM

  It's all about trust at the end of the day. And given that it was exposed that Apple, Microsoft, Meta, Google etc all collaborated with the US government to provide surveillance (PRISM) by Edward Snowden, how we can trust them ever again?

  • fragmede

    last Friday at 9:12 PM

    Did they collaborate? Google freaked out when Snowden revealed what the NSA was doing.

    • Synaesthesia

      yesterday at 3:46 AM

      They definitely did collaborate with the NSA.

• slim

  yesterday at 7:15 AM

  the purpose of this move is to feed your private conversations to ai

Everyone is hypothesizing government backdoors and whatever else but to me there's a simpler and more obvious reason - AI.

Companies started pushing E2EE a few years ago because users' private messaging data used to be a liability. Now that the data can be fed into LLMs for training and inference its value has gone up significantly, and the privacy and security tradeoffs are suddenly worthwhile.

PMs across the industry are pushing product decks with "conversational AI assistants" to get their next promotion. I've been in more than one of these meetings myself. If the data is encrypted then there's no way to build this kind of stuff.

• Archonical

  last Friday at 9:52 PM

  It's around the same time they announced their Applied AI org under Boz, which is responsible for data for Avocado/Mango/Watermelon training now. The timing certainly doesn't help.

So apparently this was opt-in, much like Telegram's OTR chat feature, and thus completely different than WhatsApp where it has always been default. Not a good look regardless, but the few who went into chat settings for a specific person to turn this on in the first place will likely just switch to WhatsApp or another app rather than continue without it.

• last Friday at 3:38 PM

It could be a move to have parity with TikTok, where they claim it’s for safety reasons. I’ve been seeing advertisements for Instagram touting their child/teen protection features. Seems like they’re really trying to beat the allegations that Instagram is bad for children’s health.

https://news.ycombinator.com/item?id=47241817

• dmix

  last Friday at 2:08 PM

  Protecting kids and Terrorism, always the reason why nobody is allowed to have privacy on the internet.

  • nunobrito

    last Friday at 2:23 PM

    Cars nowadays are packed with microphones and permanently connected to the internet on daily basis so that drivers can have remote assistance when the car breaks once every 5 years or so.

    • youknownothing

      last Friday at 2:57 PM

      And also so employees of said companies can spy on drivers and make fun of them: https://www.reuters.com/technology/tesla-workers-shared-sens...

      • stephbook

        last Friday at 3:13 PM

        Which just shows that consumers don't care. Tesla's camera surveillance wasn't exactly secret.

        • nobodyandproud

          last Friday at 3:38 PM

          Equating what companies get away with, as the clear signal to what consumers care about.

          And billionaires and nine-day old alts wonder why they need a bunker.

        • Sohcahtoa82

          last Friday at 7:20 PM

          Customers care, but not enough to actually change purchasing patterns.

        • mounram

          last Friday at 7:48 PM

          They care, but it is not in their top priorities

    • Sayrus

      last Friday at 2:44 PM

      I keep hearing this one. But at least for EU, the eCall system requires external communication to be disabled until activated during serious accident. It cannot be used for tracking the vehicle in real-time.

      Some parts of the legislation (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32...):

      > 2. The personal data processed pursuant to this Regulation shall only be used for the purpose of handling the emergency situations referred to in the first subparagraph of Article 5(2).

      > Manufacturers shall provide clear and comprehensive information in the owner's manual about the processing of data carried out through the 112-based eCall in-vehicle system. That information shall consist of:

      > the fact that there is no constant tracking of the vehicle;

      That vehicle nowadays are equipped with always-on internet and microphones is not related to remote assistance.

      • SV_BubbleTime

        last Friday at 2:58 PM

        This is such misdirection.

        Your car if new enough, IS reporting its diagnostics including GPS via cell. All the time. This isn’t exactly personally identifiable so they get away with it just fine.

        This is unrelated to the microphones and assistance systems.

        • cluckindan

          last Friday at 3:59 PM

          It becomes personally identifiable through correlations with other datasets.

          That is the kind of thing people allow when they click accept or decline on those pesky ”we and our 195735 partners would like to…” dialogs.

        • Sayrus

          last Friday at 3:26 PM

          Which is exactly my point. Cars are reporting on you, but tying that to remote assistance is disingenuous.

          • last Friday at 3:59 PM

          • nobodyandproud

            last Friday at 3:33 PM

            [flagged]

            • Sayrus

              last Friday at 3:39 PM

              Happy to read your thoughts, can you elaborate on this?

      • nunobrito

        last Friday at 5:04 PM

        Kindly read point number 2 slowly.

        There are two definitions: a) Personal Data and b) Emergency Situations

        What is an emergency situation and how can a car determine it is one? These are "smart" cars which aren't nowadays smart enough to process all your data locally, so that data is sent to servers elsewhere which process if either points a) or b) apply.

        It is your choice to believe that voice data is ever deleted once acquired by governments and entities thirsty to benefit from that information.

        For security experts this is just another "I told you so" within a few years.

        • Sayrus

          yesterday at 3:22 PM

          Emergency situations are defined by two situations: severe accidents and manual press of the button. Article 6 covers the data being sent, Article 5 covers the manufacturer's obligations. Your audio during the accident and your last three locations may leak, but the eCall system is not designed for a permanent phone-home system. If I remember correctly, you can't even use the eCall SIM for tracking as that'd encourage people to disable safety features.

          All the things you are talking about, permanent phone-home, tracking of location, audio and video, driving habits, are tracked, sent and resold. That's what smart cars do. But it is not done through the eCall system. See it from the company perspective: why would they risk penalties for non-compliance when they can gather and resell all personal data with no risks using their own system instead of a safety one?

    • officeplant

      last Friday at 5:48 PM

      One of my favorite things about going EV is the forums tend to be full of paranoid nerds which means someone will be willing to try desoldering the cell modem off their boards to see what happens.

  • hackingonempty

    last Friday at 5:44 PM

    Also drug dealers and money launderers.

    https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalyp...

• maqp

  last Friday at 3:22 PM

  The sad part is, Instagram is exceptionally damaging to kids for a disjoint set of reasons.

  • throwfaraway4

    last Friday at 3:37 PM

    As is social media in general. I highly recommend reading the Anxious Generation

• butlike

  last Friday at 3:35 PM

  It's bad for EVERYONE's health. Try to limit your usage and you'll feel better. I promise you'll feel better.

• jszymborski

  last Friday at 2:49 PM

  Protect your kids from whom? Surely not Meta, which is my main concern.

• plagiarist

  last Friday at 3:14 PM

  It certainly is unsafe for their AI training corpus. Win / win if they can also lie about protecting children as a motivation.

• PunchyHamster

  last Friday at 2:10 PM

  More like excuse

• varispeed

  last Friday at 2:12 PM

  How these protections are working when I get served literal porn every couple of shorts on Instagram?

When Meta starting introducing E2E messaging it was a huge push. I wonder why they're doing away with it.

• gmerc

  last Friday at 2:27 PM

  It was for plausible deniability because of regulatory scrutiny. Regulator's dead now, so now there's no downside and only upsides to spying on your users.

  • dngray

    last Friday at 2:53 PM

    They never did this for user privacy, and yes I think you're spot on. This was just to remove liability.

    Now it just costs them the data and development cost to maintain. Any remaining problems they'll throw some crappy AI moderator at to fix.

    • gmerc

      last Friday at 3:14 PM

      Not hard to be right about this when you worked there at the time ;)

  • mpalmer

    last Friday at 10:40 PM

    > no downside

    That is not the view their legal department takes, I guarantee it. Congress ain't gonna keep its composition indefinitely.

  • infinitewars

    last Friday at 3:25 PM

    Palantir

• john_strinlai

  last Friday at 1:59 PM

  i am guessing that they just dont really need to pretend to care anymore. e2e messaging was a big marketing push, not ever an ideological thing. i assume they no longer believe the marketing benefits outweigh the downsides.

  • varispeed

    last Friday at 2:14 PM

    Probably Whatsapp is next, if it isn't quietly already.

    • garbawarb

      last Friday at 2:52 PM

      I doubt it, E2E isba huge part of Whatsapp's selling point considering it's exclusively a messaging app. Instagram is primarily a social app with messaging features.

      • gzread

        last Friday at 3:47 PM

        Normal people don't choose a messaging app based on E2EE but based on whether their friends use it.

        • grvdrm

          yesterday at 5:08 PM

          "Your security code with X changed"

          "What's a security code?"

    • deafpolygon

      last Friday at 2:17 PM

      > Probably Whatsapp is next, if it isn't quietly already.

      And I will be pushing to remove WhatsApp if that’s the case.

• paxys

  last Friday at 7:14 PM

  Because they realized they need the data for AI

• gzread

  last Friday at 3:46 PM

  PR. They wanted to seem like the good guys, but they get your messages through backdoors like the automatic backup.

  • modeless

    last Friday at 4:30 PM

    You're thinking of Apple. WhatsApp backups are not stored by Meta. Apple is the company that breaks their "end-to-end" encryption by backing up the encryption keys to their own servers.

    • topranks

      last Friday at 7:34 PM

      You can opt-in to encrypting those backups so Apple have no access.

      • modeless

        last Friday at 8:13 PM

        Yes. I believe a small percentage of Apple users do this. Unfortunately that doesn't prevent Apple from reading your messages from the backups of the vast majority of people you correspond with.

Is this legitimate? It's so incoherent to see this blurb at the top saying it's being retired while everything underneath is pitching the value of e2e.

On the other hand Messenger has moved to only supporting e2ee chats, wonder why the difference.

• GuB-42

  last Friday at 3:13 PM

  To me, Instagram is a public platform at its core, where people publish things for the whole world to see. Private messages are just a secondary feature. It is like having a conversation in a restaurant, where the guy at the next table can listen to everything, but usually doesn't. Good enough for planning a surprise party, not for truly sensitive information. Kind of like private messages in Reddit, Discord, etc... a convenient feature, but don't expect real privacy.

  Messenger has a higher expectation of privacy, Facebook is more at the "group of friends" level. While Instagram is a public restaurant, Facebook is more like a house party. WhatsApp has the highest expectation of privacy as it is designed for private, often one-to-one conversations first.

  • ajsnigrutin

    last Friday at 3:39 PM

    Sure, but if you already have e2ee, it takes work to remove it... why invest the time to do that?

    • gzread

      last Friday at 3:47 PM

      It also takes work to keep it working and it may have a lot of bugs already, that are hard to fix because of it. A non-E2EE chat app is very easy to make.

• paxys

  last Friday at 7:33 PM

  WhatsApp and Messenger are pure messaging apps. For Instagram, DMs are just a tiny part of the overall experience.

There's a general trend right now against privacy and in a more general sense against freedom. More and more companies are on board with it. I'm not sure if anyone in HN has any useful advice in this regard. I feel like I don't know what to do about the internet for the next 5-10 years. Does this particular measure matter very much? No, but it's another brick in the wall.

• Spooky23

  last Friday at 4:09 PM

  The US is building out the infrastructure for a police state. The people who control the consolidated tech platforms are either spearheading or collaborating with that process. Privacy as a concept isn't even in the cards.

  You need to be prepared to avoid saying naughty things on the internet. Otherwise, perhaps someone will figure out that you great-great grandfather didn't sign in the right spot in 1897 and you're presence in the United States is void, retroactive to your birth. Off to El Salvador with you, enemy of the people.

  • rurp

    last Friday at 4:52 PM

    Just want to clarify that "naughty" doesn't at all mean "bad" or "immoral". It means "Anything any current ot future regime will dislike"

    • wolttam

      last Friday at 5:05 PM

      Pretty safe to say that you pointing that out counts as naughty.

      And so does my response to your comment.

      But I do wonder if self-censure is really the best strategy.

  • query_demotion

    last Friday at 5:18 PM

    >The US is building out the infrastructure for a police state.

    Take the Utah Data Center (https://en.wikipedia.org/wiki/Utah_Data_Center), combine it with the Disposition Matrix (https://en.wikipedia.org/wiki/Disposition_Matrix), informally known as a kill list for even US citizens, and it does seem like you're getting a Police State!

    • hypeatei

      last Friday at 5:27 PM

      A lot of our current privacy and liberty woes were exacerbated by 9/11. Can you imagine a Church Committee in 2026? Me neither.

      Three letter agencies have way too much power and they've shaped our culture+laws for the worse. Osama Bin Laden has done way more damage to American citizens' lives than he could've ever dreamed of.

      • Spooky23

        last Friday at 6:37 PM

        By design.

        Just like the KGB and Putin's minions, Bin Laden correctly saw fault lines and weaknesses in the US an exploited them. He did what he did with a long-range context in mind. The "three letter agencies" were neutered in the 90s as part of the peace dividend which is why he was successful. The Russians used "active measures" with intelligence in the US 2016 among other times and Bin Laden chose terrorist violence. The Russian misinformation strategy is tried and true and corporate actors now use it successfully as well.

        The whole thing sucks. This Iran adventure lays the vulnerability of the US military machine pretty bare. More, escalated conflict is probably in the world's future for decades to come.

        • query_demotion

          last Friday at 8:22 PM

          This wasn't by design. Obama had options. He campaigned against mass surveillance but flip-flopped once in office, installing the very surveillance levers he criticized. “No more secrecy,” he said. “That is a commitment that I make to you.”[1] If his only option was to install these surveillance levers, then I guess American democracy is just a lost cause.

          [1] https://www.pbs.org/wgbh/frontline/article/obama-on-mass-gov...

  • last Friday at 4:37 PM

  • mc32

    last Friday at 4:35 PM

    It feels to me Europe and the UK, in the western world, are further ahead on the legal road to surveillance than the US.

    • Sohcahtoa82

      last Friday at 4:52 PM

      Someone pointed out something to me and it's really struck a chord with me.

      In the USA, we hate the government collecting information on us, but shrug our shoulders when corporations do it.

      In Europe, it's the exact opposite. They created GDPR to restrict how corporations collect and share data about you, but they shrug their shoulders at government doing it.

      Obviously, this is incredibly reductive and over-simplified, but the general idea of it feels pretty true.

      • toxik

        last Friday at 4:57 PM

        Sorry, this is just not true. Stasi was a government agency, and it was from this kind of thing that European privacy advocacy sprung up.

    • ls612

      last Friday at 4:44 PM

      [flagged]

      • mikepurvis

        last Friday at 4:50 PM

        Sure, but I think the point of this thread was (or should be) what can be done in the US to resist this. There's a lot of things the US resists doing because voters who never traveled outside of it can be convinced that what it is as implemented elsewhere is somehow flawed or worse than the status quo.

        You see this exact pattern with real health care, common sense gun laws, investment in mass transportation, probably more that I'm not thinking of.

        • mp05

          last Friday at 6:33 PM

          > Sure, but I think the point of this thread was (or should be) what can be done in the US to resist this.

          I read that as "we're not going to sit with the uncomfortable implication that the places being held up as policy exemplars are also the places criminalizing speech."

      • gzread

        last Friday at 4:46 PM

        What differentiates correct politics from incorrect politics?

      • messe

        last Friday at 5:18 PM

        Who's we?

      • last Friday at 4:48 PM

• caconym_

  last Friday at 5:05 PM

  > I'm not sure if anyone in HN has any useful advice in this regard.

  Self host. It's still possible to buy computer hardware and install FOSS replacements for most/all of the services you need, and plumb it all through to your mobile devices using wireguard/tailscale. If you're behind a CGNAT you can proxy it through a cheap VPS that won't fuck you on bandwidth costs. Thanks to Proxmox, I probably have better uptime on my services than e.g. Github these days.

  When it becomes impossible to get open PC hardware, I don't know. I like to think I will just stop using the internet for anything besides the bare minimum NPC type activities that are required to engage with the institutions of society.

  • abnercoimbre

    last Friday at 5:13 PM

    If you don't know where to start check out the Linux Prepper [0] podcast. (I'm not affiliated, just a listener who enjoys the show.)

    [0] https://podcast.james.network/@linuxprepper/episodes

• aavci

  last Friday at 3:41 PM

  I wonder if promoting open-source tooling and best practices could make it easier for new apps to adopt security features like E2E encryption. For example, someone building a chat app might not add E2E encryption unless they have access to user-friendly tools and are encouraged to do so.

  Startups that initially choose the more private implementation version often face a disadvantage. They may not see immediate benefits and instead experience drawbacks, such as caring a bit more than their competitors. For example, an AI plugin using local large language models for privacy might not be rewarded as much as a competitor who fully embraces cloud-based solutions.

  • starkparker

    last Friday at 4:15 PM

    That's all fine and good but this is Meta removing an existing implementation. How would you stop decisions like that?

• reactordev

  last Friday at 3:51 PM

  If you’re a good boy then you have nothing to hide right? Not even your passwords…

• john_strinlai

  last Friday at 3:58 PM

  unfortunately, since the messaging/trend isnt "we are against privacy" (it is "we are protecting children, which reluctantly means we all have to sacrifice a wee bit of privacy"), it is really hard to fight back without being labelled as someone who is against protecting children.

  but the advice is basically the same as it always has been:

  - talk to your friends and family about it. do it with passion, but without hyperbole or conspiracy or aggression. any person you can convince to care is a win. organize with like-minded people.

  - talk to your representatives in government. vote for representatives that are pro-privacy (when possible). convince your like-minded friends and family to do the same.

  - to the greatest extent possible, dont purchase/use products/services which are facilitating the trend. (but, you also need to be realistic or you will burn out! and that is a bigger loss overall).

  - if you are a decision-maker at work, or have any sort of input, leverage it as best as you can to make pro-privacy business decisions. however, similar to the above point, recognize that you still need to be realistic and dont get yourself fired arguing some decision. it is better to make 1,000 nudges in the right direction than it is to be fired/burn out trying to make 1 big nudge.

  - support organizations that align with your beliefs. this can be monetarily, or by volunteering, or by spreading awareness of the organization itself. for example, many people have never heard of the electronic frontier foundation and have no idea what they do. lots of people dont know of the ACLU either (or, maybe they have heard the name, but dont know what they do or why it matters).

  • trinsic2

    last Friday at 4:10 PM

    >unfortunately, since the messaging/trend isnt "we are against privacy" (it is "we are protecting children, which reluctantly means we all have to sacrifice a wee bit of privacy"), it is really hard to fight back without being labelled as someone who is against protecting children.

    That's not what I am seeing on the ground. Many discord users I have seen talk about this issue frame this as an attack on freedom and privacy by hiding it behind the same narrative that has been used so many times before of protecting children. You can only push fake narratives so far until people start getting the message that people are hiding nefarious attacks on society behind fake movements.

    • john_strinlai

      last Friday at 4:13 PM

      >Many discord users I have seen talk about this issue frame this as an attack on freedom

      good! ideally, someone is helping them organize and action those thoughts and feelings outside of whatever discord channel you are in.

      i am referring to how it is being framed by the people pushing the agenda. age verification laws (as an easy example) arent being advertised as "we want to spy on you", they are being advertised as "this will protect children from harms".

      talk to debbie in accounting instead of babmorley420 in discord, and ask her opinion. she is not likely to frame it as an attack on privacy/freedom. she is likely to frame it as a necessary sacrifice for the greater good. and her opinion also matters, she also votes. we need to convince the debbies of the world -- they outnumber the babmorley420s

      • trinsic2

        last Friday at 4:20 PM

        Agreed. What I meant to say is at least the younger generation are starting to see past this smoke screen more so now than maybe 20 years ago.

        • int_19h

          yesterday at 2:16 AM

          Now if only they actually went out and voted...

        • john_strinlai

          last Friday at 4:27 PM

          that is very refreshing to hear.

          i teach tech in college and just earlier today made a post about how i am not seeing the same when i compare my current students to students 5, 10, or 15 years ago. i hope that i am the one in the bubble.

          • trinsic2

            yesterday at 5:30 AM

            I'm part of a community around the stop killing games initiative. So maybe it's a bit slanted because most might be pc gamers (technically inclined). But it's a pretty big movement on this front and most of them see right through this. A lot of them don't like what discord is doing. Whether or not they'll put there money where there mouth is is another matter.

• Cider9986

  last Friday at 5:17 PM

  You could try becoming a privacy advocate. https://www.privacyguides.org/en/activism/

• j_bizzle

  last Friday at 4:29 PM

  I’m truly on the fence about all of this.

  On one hand, I think a lot of the larger issues and divisions we’ve seen in society over the last 20 years are a direct result of our primary means of communication, entertainment and information being one that allows such ease of impersonation. While most of us here understand just how much Internet content is created with influence as a goal, and the posted by accounts with false identities, a majority of people still don’t. (And many who do don’t understand just how prevalent it is). I also think that sadly we’ve demonstrated that when people feel they are anonymous and beyond consequence, they’re willing to say and advocate for some terrible things which they might otherwise not have, and seeing others say those things reinforces their willingness to say and do them. If social media and internet norms of today had held the original Facebook model of requiring verification of your actual identity (back in the day .edu email days), I truly think we would live in a much different and in many ways better world.

  On the other hand, I fully acknowledge that many of the people pushing for the removal of privacy and encryption are not doing so for altruistic reasons, but so that they have a more data to mine and monetize, or have the ability to monitor to a frightening degree, and that these tools once available will be available to any regime or government, so even if the ones currently pushing do have naively good intentions, the next ones very well may not.

  But, I also struggle with the knowledge that for sophisticated parties, the privacy that most people think they have is a sham to begin with. There are already many tools available to piece together information sources and build a horrifyingly complex and accurate picture of individuals activities and identities. So I wonder if the illusion of privacy isn’t worse than the public at least being forced to confront the fact that they have none in the first place, and therefore being able to truly see and address the issue, while the security minded and technical individuals will always find a way obfuscate their identity and activity, just as they always have.

  • nemomarx

    last Friday at 4:37 PM

    Facebook accounts today still have identity verification (they often ask for scans of IDs, etc) and yet it doesn't seem to result in a noticeably improved discourse there compared to say, Twitter before Musks takeover. I don't think anonymity actually changes discourse that much.

  • everdrive

    last Friday at 4:35 PM

    In my opinion anonymity is a great red herring. The worst offenders on the internet have verified accounts and are public figures. The problem is algorithmic content, prioritizing for engagement and outrage, and then connecting _everyone_. We had what was effectively anonymity in the 90s, but really had NONE of the crazy society-breaking extremism we see now. Getting rid of anonymity will really do NOTHING to halt the march of internet-fueled extremism.

    • abnercoimbre

      last Friday at 5:21 PM

      Everything is a sliding scale. There would be improvement from verified identities (and doing so through a zero-trust network is feasible.) I agree the worst actors wouldn't care at all, and in that case we address the algorithmic amplification problem.

    • salawat

      last Friday at 7:11 PM

      This. People don't recognize that a tech company with an algorithmic feed is indistinguishable from a public awareness filter. It allows a couple hundred to 1000's of people to set the Overton window of millions/billions. When we actually didn't go algorithmic and went off more natural filtering (geographic, chronological, scope/impact based), it was a modality that one would be hard pressed to even find a schoolchild that couldn't end up being able to meaningfully navigate the space with due training. This is, of course, exactly why monied individuals foam at owning any of the few consolidated media outlets/tech companies. Societal scale leverage on the machine of public awareness.

• wslh

  last Friday at 4:36 PM

  I sometimes feel a bit weird about this. In the 90s it felt like "we" won the crypto wars: PGP, the fight over export controls, the Clipper Chip, etc. There was a strong sense that privacy and strong crypto had become settled questions.

• fsflover

  last Friday at 4:06 PM

  > I feel like I don't know what to do about the internet for the next 5-10 years.

  Switch to decentralized, e2ee alternatives, support https://eff.org

  • trinsic2

    last Friday at 4:24 PM

    I feel like e2ee on phones with OSes from the big two is a lost cause. I'll bet this is the year where open hardware/bios starts getting more popular, hopefully. So we can have open hardware/software.

    • sisve

      last Friday at 4:38 PM

      Even with e/os/ or another u De-googled version of android?

      Not directly to you but in general: I do not think (most) of Europe is going the same direction as US. I actually see a lot of hope in response to EU leaders about digital infrastructure, communication & security. we have started to stop realing on America, but it will take 10-20 years before you see the entire crash trump made

      • trinsic2

        yesterday at 5:20 AM

        Yea sorry I was speaking from the U.S. perspective. But still Europe is still involved in certain things like age gating. That is a clear sign that there are some entrenched interests that want to erode privacy on that front. I hope that moving away from U.S. corps for communication services happens. We (U.S.) really need a kick in the pants. I feel like there is authoritarian agendas everywhere now though.

    • gzread

      last Friday at 4:47 PM

      Is Google snooping your SimpleX chats?

      • fsflover

        yesterday at 10:03 AM

        We don't know. They seem to have this capability though.

    • fsflover

      last Friday at 4:33 PM

      GNU/Linux phones already exist. See: Librem 5 and Pinephone.

      • vova_hn2

        last Friday at 5:24 PM

        I find it really off putting, how weak is their hardware, compared to a normal Android phone in a similar price range.

        • fsflover

          last Friday at 5:44 PM

          Weak hardware can work quite well with optimized and non-bloated software (which doesn't constantly phone home). For example, maps and Youtube work smoothly on Pinephone with SXMo. See also: https://puri.sm/posts/the-danger-of-focusing-on-specs/.

          • vova_hn2

            last Friday at 5:55 PM

            I hope so, but I just don't understand what exactly causes such massive price difference.

            Is it because this kind of phones are a very niche product so they can't benefit from the economy of scale?

            Maybe android phone manufacturers can get better deals from chip manufacturers because they buy chips in large quantities?

            • fragmede

              last Friday at 9:35 PM

              Yes exactly that. The weak hardware at those prices are the best they can afford. The economy of scale that they can afford let's them charge that little for flagship phone and still makes money. People won't put their money where their mouths are, we're all too cheap to pay what things are really worth.

              • trinsic2

                yesterday at 5:22 AM

                It's not just this but there are also devices that can be sold artificially cheaper because advertisers are the real customers

            • fsflover

              last Friday at 6:30 PM

              Niche product, non-standard components, strict requirements of free drivers with GNU/Linux support: https://puri.sm/posts/breaking-ground/

      • subscribed

        last Friday at 5:06 PM

        If you like privacy without security then yeah .

        • fsflover

          last Friday at 5:41 PM

          There is no security in a vacuum. Security depends on your threat model. I use Firefox with NoScript and never run untrusted apps on my Librem 5.

• peyton

  last Friday at 3:40 PM

  As a California resident I request to download my personal data from every service I can, and I’m constantly surprised. We each have scores for all kinds of things. The local power company keeps a “Green Ideology” score on me.

  • newsoftheday

    last Friday at 4:07 PM

    When I see the word "score", it reminds me of the CCP social scoring system.

    • scarecrowbob

      last Friday at 4:23 PM

      Weird... when I see something done by US-Based capitalist and attributed to communists half a world away, it makes me think of the Powell Memo.

      • newsoftheday

        last Friday at 6:28 PM

        That is weird, the US didn't ask the CCP to invent social scoring.

        • scarecrowbob

          yesterday at 12:58 AM

          I mean -also- weird to claim that the CCP invented scoring folks, but even if they did, it'd be hella weird to think that somehow they helped a US local power company implement it...

          Look, I get that "CCP Bad". It's just always wild to see folks try and make that case when something has literally nothing to do with it, especially while there are plenty of pretty horrific and material mechanisms in play without pretending that the big-O Other is to blame.

  • johnisgood

    last Friday at 3:57 PM

    It makes me curious what other scores (I would call them labels) there are.

  • wiether

    last Friday at 3:48 PM

    How is that even legal?

    • natch

      last Friday at 4:24 PM

      This is in the US. It’s a free country. Things are legal by default (that’s a good thing) until the system notices them and makes a law.

      Having seen how things work where freedom is not the default, I much prefer freedom.

    • stackskipton

      last Friday at 4:05 PM

      Because it's not illegal. Most data privacy laws just require that user can see data collected about them and prevent sale of said data in optout fashion.

      There are rarely laws around preventing collection of said data or using said data for some new service.

      • wiether

        last Friday at 5:26 PM

        But it's not any data, it's political orientation data!

        Sometimes people talk about GDPR being only the cookie banner, but thanks to it, its forbidden to collect that kind of data.

        https://gdpr-info.eu/art-9-gdpr/

    • knowitnone3

      last Friday at 4:51 PM

      [dead]

  • dheera

    last Friday at 4:28 PM

    How do they know your ideology? Are they scraping your social media or running sentiment analysis on your customer service chats?

    • _djo_

      last Friday at 5:34 PM

      It’s likely some customer segmentation label generated through PCA or some other clustering approach.

      The qualifying criteria is probably just having picked an offer for renewable-sourced energy in the past, indicating that it has some importance to you. So you will be given more green energy offers in future.

      Every company segments its customer base this way for marketing. Sometimes it’s even useful.

      • dheera

        yesterday at 7:02 PM

        I see... so maybe I should use PCA to give them the most uncorrelated response to all of their clusters as possible just to mess with them.

    • cucumber3732842

      last Friday at 5:04 PM

      They probably don't care. It's probably a mostly BS number. But they probably have to have it and have it at least look like they're trying to be serious about generating it in order to qualify for preferential treatment on some sort of permitting or write off some class of investment in a slightly better way at tax time or something.

      I'm not sure if this is better or worse than them doing it because they believe in it.

• dheera

  last Friday at 4:27 PM

  E2EE on Instagram was never real, trustable E2EE. No open-source client, no way to verify that private key is never sent to server, and encryption of a key with a low-entropy PIN is effectively plaintext.

• add-sub-mul-div

  last Friday at 3:41 PM

  You're on a site with a surprisingly high amount of support among commenters for trading privacy and freedom for convenience and comfort where it aligns with their religion/other biases or desired consumer experiences. I don't know if this the best place to ask for advice.

  • pjc50

    last Friday at 3:59 PM

    I'm not sure people realize that HN is already at the most libertarian end, and all the discourse spaces which are much closer to actual power and legislation are much less pro-privacy.

    • davorak

      last Friday at 4:09 PM

      Historically, like 10-20 years ago, libertarian would be staunchly pro privacy. Is this no longer the case? If libertarians have dropped this stance, since it is so close to what was the core beliefs, I really have no mental model of the philosophy/politics for libertarians any more.

      Any primer/link on what current libertarians believe is welcome.

      • natch

        last Friday at 4:31 PM

        It’s possible to want something without wanting to live in a system where there is a nanny to enforce that thing. Other means of enforcement exist, such as free markets.

      • pjc50

        last Friday at 5:03 PM

        Yes, but there's really not very many libertarians left who haven't cast their lot in for Republican support, resulting in the present situation. Not that there were many to begin with.

      • scarecrowbob

        last Friday at 4:31 PM

        You might find it useful to distinguish between right and left libertarians.

        All my anarchist (left libertarian) friends are pretty consistently opposed to state and corporate surveillance. There is plenty of theory in a canon of literature that goes back to the mid 19th century, even as there are many subgroups and spurs off that general line of thought all with their own sets of (usually somewhat) consistent lines.

        If you want something short and brutal, I am a fan of "Desert" by anonymous, but "A Utopia of Rules" by David Graeber is not a bad thing to read and probably closer to a popular line. Or the CIA-Coded Yale academic James Scott has a lot to say, "Two Cheers for Anarchism" and "Seeing Like a State" both seem to have influenced a lot of people.

        Historically "right libertarians" (the US Libertarian political party, for instance) have been, uh, "less consistent" in their thinking, so you might have a hard time finding anything that looks like a "philosophy" in that branch of "thought". Plenty of goofy-ass ideas, but little consistency except a strange ability to begrudgingly conform to GOP politics at the end of the day.

    • iamnothere

      last Friday at 6:46 PM

      Reddit seems to have drifted back to more libertarian than HN on privacy issues. At least in technical subreddits. Not sure why that is, perhaps there are more users here whose salaries are tied to surveillance.

• dfxm12

  last Friday at 4:18 PM

  In this specific case you can avoid Meta. In general, if you're in the US, you probably have a primary election coming up soon and certainly have a general election in November. Ask your politicians what their thoughts are on these topics and make an informed vote. Continue to pressure the incumbents as well.

• ls612

  last Friday at 3:44 PM

  It's depressing to think that after the abuses people suffered during the lockdowns the response has been to embrace authoritarianism even more. It makes me fear how far this could go before people realize how bad it is.

  Fundamentally I think that liberal democracy won't be able to survive compute, communication, and storage being cheap, combined with asymmetric encryption. I really think there should be an article illustrating just how much that last one is fundamental to making the apparatus of control cheap and effective in a way that 20th century regimes could only dream of.

  • Larrikin

    last Friday at 4:14 PM

    What abuses?

• krystalgamer

  last Friday at 3:38 PM

  i don't understand this doomer mentality regarding the internet.

  internet is a service that you choose what to engage and how. don't like a platform? find another, build it or stop using it altogether.

  personally, i find these things really great has it helps nudge people into the more decentralized web. a few years ago those who were pushing for privacy respecting apps and platforms were deemed too paranoid.

  • ultratalk

    last Friday at 3:47 PM

    Network effects will keep a person on a platform until a critical mass of their social circle decide to leave all at once. I'm no expert, but I suspect that that critical mass is pretty high, maybe more than 50% of a person's circle. So it's not exactly vanilla free-market competition. Entrenched players have a pretty big advantage.

    • krystalgamer

      last Friday at 3:52 PM

      what does your social circle being on Instagram bring to you? seriously, this picture-sharing app has evolved into this content spread machine that brings very little value.

      • ultratalk

        last Friday at 4:00 PM

        When most of your social circle exists on one platform, you tend to use that platform less for its specific features, and more because of the fact that all your friends are there. I don't personally use Instagram, and this is anecdotal information, but I know a lot of people who only use Instagram to see what their friends and family are up to, and to watch the occasional reel.

        But you're absolutely right about Instagram's evolution. It's crazy.

        • krystalgamer

          last Friday at 4:48 PM

          this is a very 21st century thing, the ability to know what everyone is doing at any time. extremely voyeuristic too.

          the only social circle that truly matters is the geographically close one. no amount of E2EE or fancy chat app will replace being physically present.

          • tredre3

            last Friday at 5:25 PM

            First you said that people should use decentralized platforms. Now you acknowledge that there's nobody of value on those platforms so now you say people should stop wanting to connect in the first place.

            I mean, okay? Next time just say social media is a cancer, and don't waste our time moving goal posts.

            • krystalgamer

              yesterday at 1:24 AM

              > that there's nobody of value on those platforms so now you say people should stop wanting to connect in the first place

              that's exactly what i said and not a figment of your imagination.

              if your social circle mostly exists on instagram like the person that i was replying to mentioned :), then you have no social life. any of these platforms is just an add-on to real social interaction. prioritize the real thing and the platform stops mattering.

              > social media is a cancer

              it isn't but your comment is.

    • happosai

      last Friday at 4:27 PM

      Ah Network effect, That's why we all are still using Skype, microsoft messenger and ICQ.

      You don't have to wait for everyone to switch, in fact it's pretty normal to reach different people on different chats.

      https://xkcd.com/1810/

      • ultratalk

        yesterday at 4:15 AM

        Well, maybe it was normal ~10 years ago, when that comic was published, but is now getting rarer and rarer, as each new generation consolidates itself on a single platform.

  • Schlagbohrer

    last Friday at 4:08 PM

    Many people make their livings from these platforms. They cant leave without abandoning most of their income stream.

    • krystalgamer

      last Friday at 4:42 PM

      find a different employer? what kind of argument is that.

Socials are caught in the innovator's dilemma.

Given the dependence our society now has on the internet, it's bonkers to me that more VCs aren't rethinking their investment strategy. Privacy is not some niche concern anymore, check out the response to Flock for example.

• Cider9986

  last Friday at 5:25 PM

  Some are. See simplex.chat, anytype.io.

The only reason I can think of for this change is governmental pressure. I don’t see how it benefits the platform itself (nor its users).

• arlort

  last Friday at 5:02 PM

  I can think of a few reasons why a company built on profiling (and advertising to) user interests might be interested in the private conversations of their users

  • mvrckhckr

    yesterday at 1:37 PM

    In that case, why introduce the feature in the first place?

• paxys

  last Friday at 7:17 PM

  There is a product reason - AI features are fundamentally incompatible with E2EE. If they want to bring more AI generated experiences and content into Instagram then the data needs to be accessible by them.

  • mvrckhckr

    yesterday at 1:38 PM

    That's an interesting angle. I'm not sure I see the direct connection, but it can be a user choice.

• gzread

  last Friday at 4:51 PM

  I can think of some. Less code complexity to support a feature that didn't work properly and nobody was using? More ability to detect spam?

  • mvrckhckr

    yesterday at 5:53 PM

    Wasn't it automatically used when it was implemented?

It feels like it's time to move to lemon writing over paper on normal post. Only way you can no talk freely.

• quectophoton

  last Friday at 10:04 PM

  Except instead of sending through post offices, it'd probably be through "runners" like on Mirror's Edge.

Just make it an OS feature. There’s no need for the application to know the exact contents. Other than search, but for most messaging and other apps the device can easily do indexing

Textbox with attribute ”encrypted”. Keys in the enclave/keychain.

the timeline for all of this is not a coincidence. meta spent millions lobbying for age verification laws that require content scanning. hard to scan content that's encrypted.

This feature has never been available to me- it just threw an error each time. Wonder how far it actually got rolled out?

Never rely on a platform used by the masses to perform E2EE. It is far too easy to strip away E2EE for targeted users without their knowledge as they maintain the server and client code. This advise is to protect from corporations gobbling up and ultimately leaking sensitive data. Spooks can target the device itself via debug access for nation state level threats.

Consider instead using a code word or phrase to move sensitive conversations to something self hosted such as jabber using OMEMO XEP-0384 and XEP-0373 OpenPGP for XMPP and SASL SCRAM. OMEMO is an implementation of the Signal protocol on top of the XMPP protocol.

e.g. "_Expletive_! I stubbed my toe!" other-person: "lol geezer watch where you are walking." conversation quietly and temporarily moves to the pre-shared self-hosted Jabber server. Temporarily because going dark can draw attention. Feed the big chat platform boring garbage and misdirection.

• impossiblefork

  last Friday at 3:52 PM

  People catch the spooks and their exploits all the time though.

  It is possible to defend against them. Maybe not on your phone though.

  • Bender

    last Friday at 3:54 PM

    Agreed. I just mentioned that for the spooks who don't like I am suggesting moving sensitive conversations elsewhere using basic opsec. I assume the farm recruits on HN are probably just as concerned about AI taking their jobs. Surely someone has bought AI a coffee unprompted by now, maybe even flirted with the AI.

    • impossiblefork

      last Friday at 3:59 PM

      I don't quite understand your comment. I also disagree with some implications of the final bit of your first comment: encryption is obviously basic privacy, but the interesting bit is who you're talking to.

      So having a signal for switching mediums is something that I feel indicates thinking in the wrong direction.

      • Bender

        last Friday at 4:04 PM

        So having a signal for switching mediums is something that I feel indicates thinking in the wrong direction.

        It's not for everyone. I grew up with code phrases. My mom knew that if I said "I love you" to send in the cavalry. We had similar processes in the military. If I answered the phone a particular way they knew the remote site was under siege.

        • impossiblefork

          last Friday at 4:12 PM

          That's an okay use, but in that use you're not attempting to achieving privacy.

          Everyone knows you talk to your parents, but code phrases are not a way to get privacy.

          • Bender

            last Friday at 4:47 PM

            It's not for privacy in the way you may be thinking. This was long before cell phones or the internet existed and the conversation would have been over the rotary phone and it is assumed someone is in the house with me that should not be. Goal being police have authorization to kick down the door and assist the person or people that are nutritionally deficient in lead.

• Zak

  last Friday at 4:03 PM

  Unless you're actually a spy, there's no reason to do this. Just use your secure solution all the time with those conversation partners who are willing to use it.

  • Bender

    last Friday at 4:08 PM

    Unless you're actually a spy, there's no reason to do this. Just use your secure solution all the time with those conversation partners who are willing to use it.

    Fundamentally I agree with you but people will stay on the platforms where their friends are. To change that the platform would have to do something really bad such as forcing age checks and even then I think many will just put up with it to stay connected to their friends.

Did they give a reason why are they doing this?

I don't use IG although they dearly want me to, giving me a popup every time I visit, but let me talk about FB for a second (and btw FB wanted to enable cross-platform messaging on the platforms they own - Meta - which seems anti-trust-y) - when they introduced encryption on FB, they made it mandatory. They opted everyone in, and it broke Messenger. If you delete cookies you might also delete messages. Isn't that convenient?

just waiting on whatsapp to rug pull as well & then bye bye privacy & meta from my life

• dylan604

  last Friday at 2:35 PM

  Wouldn't bye bye meta be hello privacy into your life?

I wonder if this is the start of a trend or just a one-off?

• odo1242

  last Friday at 3:28 PM

  Probably a one off? Instagram’s e2ee was opt-in from the start- and meanwhile Facebook Messenger is now “e2ee for everyone” and none of this is affecting the main e2ee messaging apps people use - WhatsApp, Signal, and iMessage

• nunobrito

  last Friday at 2:10 PM

  TikTok replied recently it wouldn't encrypt its messages either, citing user security as reason.

  • last Friday at 4:01 PM

In a sane world, removing E2E encrypted messaging would be worthy of huge fines.

This could obviously tie to sending you more ads.

It could also tag people communicating about topics ig chat that it is actively suppressing.

They may be looking for an uproar to reverse the policy as so far, it's just words.

because they want to read your messages for training ai and for advertising

• gitaarik

  yesterday at 6:16 AM

  And maybe to also have a better relationship with the government?

We all know what this means.

Use this https://www.ricochetrefresh.net/ Chat and file transfer over tor

[dead]

[flagged]

• apopapo

  last Friday at 2:13 PM

  It's not only the united states of America. These tyrannical views have been brewing everywhere for years, and there was not enough public counter-narrative to these ideologies.

• krystalgamer

  last Friday at 3:42 PM

  because everyone is forced to use Instagram messaging, right?

• chromic04850

  last Friday at 3:32 PM

  [dead]

Wait, people trust communication via Instagram thinking they are secure?

• blitzar

  last Friday at 2:24 PM

  Facebook were at both ends, the encryption was between the ends.

  • arunc

    last Friday at 9:09 PM

    Ah, OK. I was never an Facebook/Instagram user, so thanks for explaining that.