> my concern about how easy it seems for governments to get private conversations between a mother and daughter.

I struggle to understand how anyone can still think that facebook (and any other major social media platform) has any issue (moral, technical, or otherwise) with giving away any and all data from their systems, to anyone willing to pay enough or who can threaten them with fines. Why would they? Their business model is selling user data to advertisers. Do people really think they're just leaving money on the table and saying "well, that's private, people might not like that data being sold." They don't give a shit!

I also struggle to understand how anyone can look at the current social media landscape, where seemingly everyone has accounts on multiple platforms and uses them to post/message about their personal lives, and not think the us government/law enforcement is involved somehow. Does anyone really think the microphones we all willingly put inside our homes that are controlled by one of the largest corporations in the entire world aren't readily available for intelligence agencies?

I admit I am very cynical, but it's very difficult not to be. It feels like every month we hear about how some massive platform was actually lying about handling data that they totally promised they were keeping safe and private, which is followed up some new expansion of their ability to collect said data. But we all continue to give them the benefit of the doubt, and act surprised when things like this happen.

I think a lot of people are still pretty naive about it. Most people probably believe their messages are private.

Dear kids: if it could embarrass you or get you in trouble, don't send it with a messaging app.

Kind of like "If you don't have anything nice to say, don't say anything at all"... except it doesn't roll off the tongue.

When I was in middle-high school, "private messages" got shared all the time. The first time it happens to someone, myself included, it's a bit of a ride awakening.

But once it happens, you learn that what you say online is a persistent written record which outsiders will occasionally access. I don't think that people can credibly claim to be unaware that all of their social media activity exists in a grey area between "public" and "private".

Is it possible that most people just don't care? It seems like the "I'm not doing anything wrong, so I don't care" impulse is very beguiling. Maybe events like this will be enough to snap people out of it, but I wouldn't bet on it.

> Also that apparently Facebook stores the conversations in plain (or easily decryptable) text.

This. Even with E2EE enabled, that only protects your conversations as they travel between you and facebook's servers. It does not mean that the messages are protected from facebook being able to see them. People should have zero expectation of privacy on facebook's platform(s).

That is not true. For both messenger and whatsapp, e2ee messages are not only encrypted between you and facebook servers, they are encrypted end-to-end and only decryptable on the devices. Please reconsider your level of confidence in your understanding of this.

I do not have any information about the current state of messenger, so I cannot comment.

Here is my issue with WhatsApp though:

How will I know that Meta is still shipping an application based on an uncompromised version of the Signal protocol, without malicious modifications? Auditing is the normal answer.

Sadly, Meta is not ISO27001 certified, so there's no trustworthy external audit trail.

Barring that, who is capable of auditing Meta to confirm this? Who can see the client and server sources to confirm that there is no MITM? Only Meta, on both counts.

I have to trust their word for it and I'm incapable of trusting them.

What a joke them calling it E2EE, but they have the private keys?

The parent commenter lied (most likely due to them having no clue wtf they are talking about, what a surprise on HN).

I don't think they claim that Facebook messages are end to end encrypted. They say WhatsApp are but not ones sent via Facebook.

But aren't they sending the message to Facebook first before sending it end-to-end encrypted? To make sure it isn't anything harmful /s

Or was that feature scrapped or did I misremember?

No, you 100% don't understand what you are talking about.

I absolutely understand what I am talking about.

I only don't remember exactly.