# Facebook Does Something \*For\* Privacy **URL:** \ **Category:** Miscellaneous and Personal Stuff I Must Share\ **Created:** [June 2, 2015, 2:49pm UTC](https://boards.straightdope.com/t/facebook-does-something-for-privacy/721438 "2015-06-02T14:49:04Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Steve\_MB](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steve_mb/32/5339_2.png) [@Steve\_MB](https://boards.straightdope.com/u/Steve_MB)\ **Post date:** [June 2, 2015, 2:49pm UTC](https://boards.straightdope.com/t/facebook-does-something-for-privacy/721438/1 "2015-06-02T14:49:04Z")
> [@](#): > > [Facebook rolls out new encryption features](http://boingboing.net/2015/06/01/facebook-users-can-now-use-pgp.html) > > An update rolled out today by Facebook allows users to post their public email encryption key on their Facebook profile, so others can encrypt future emails to that user… Given Facebook’s general record on privacy issues, this gives me a mental image of a pickpocket using his skills to slip money _into_ people’s pockets… 😕 ---
**Author:** ![LSLGuy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lslguy/32/5813_2.png) [@LSLGuy](https://boards.straightdope.com/u/LSLGuy)\ **Post date:** [June 2, 2015, 3:04pm UTC](https://boards.straightdope.com/t/facebook-does-something-for-privacy/721438/2 "2015-06-02T15:04:09Z")
Given their prior history this sounds to me like an attempt to get more people to use Facebook as their email provider. Which emails will be decrypted (and monitored) by Facebook as they are shown to the users through Facebook’s interface. While meanwhile stymying anyone else’s attempts to profit from the knowledge gained by reading those emails. When it comes to gigantic corporations, never assume public-spirited charity when there’s an equally ready explanation which enhances their power and profitability. ---
**Author:** ![friedo](https://avatars.discourse-cdn.com/v4/letter/f/8edcca/32.png) [@friedo](https://boards.straightdope.com/u/friedo)\ **Post date:** [June 2, 2015, 3:07pm UTC](https://boards.straightdope.com/t/facebook-does-something-for-privacy/721438/3 "2015-06-02T15:07:13Z")
> [@Steve\_MB](#): > > Given Facebook’s general record on privacy issues, this gives me a mental image of a pickpocket using his skills to slip money _into_ people’s pockets… 😕 Do you even understand how public keys work? ETA: Sorry, that was meant to be a snarky reply to **LSLGuy** , not the OP. ---
**Author:** ![LSLGuy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lslguy/32/5813_2.png) [@LSLGuy](https://boards.straightdope.com/u/LSLGuy)\ **Post date:** [June 2, 2015, 3:45pm UTC](https://boards.straightdope.com/t/facebook-does-something-for-privacy/721438/4 "2015-06-02T15:45:17Z")
> [@friedo](#): > > Do you even understand how public keys work? > > ETA: Sorry, that was meant to be a snarky reply to **LSLGuy** , not the OP. Yes I fully do understand how they work. And how they are different from private keys. And all the rest. I fully expect Facebook’s email to tout how their email is fully encrypted, thereby helping their technically naïve customers to feel secure in using it. Except of course when Facebook decrypts it on their server before showing it in the html interface to the end user. If you’re thinking of this as simply a way for Facebook end-users to publicize another personal attribute which others can use with separate email encryption programs and separate email providers then I can see your confusion about my post. You’re right in that case that Facebook wouldn’t gain anything. They also wouldn’t lose anything either, since that email stream is already never passing through their servers. IMO that’s not the long-term game FB is playing. ---
**Author:** ![Steve\_MB](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steve_mb/32/5339_2.png) [@Steve\_MB](https://boards.straightdope.com/u/Steve_MB)\ **Post date:** [June 3, 2015, 5:26pm UTC](https://boards.straightdope.com/t/facebook-does-something-for-privacy/721438/5 "2015-06-03T17:26:22Z")
> [@LSLGuy](#): > > Yes I fully do understand how they work. And how they are different from private keys. And all the rest. > > I fully expect Facebook’s email to tout how their email is fully encrypted, thereby helping their technically naïve customers to feel secure in using it. Except of course when Facebook decrypts it on their server before showing it in the html interface to the end user. These statements are mutually exclusive. If the first one is true, then you understand why the second scenario is impossible (you need the recipient’s _private_ key to decrypt, and only _public_ keys are to be found on the server). Dunning, Kruger, and I cast three votes for “the first statement is false”. ---
**Author:** ![Ethilrist](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ethilrist/32/4604_2.png) [@Ethilrist](https://boards.straightdope.com/u/Ethilrist)\ **Post date:** [June 3, 2015, 5:38pm UTC](https://boards.straightdope.com/t/facebook-does-something-for-privacy/721438/6 "2015-06-03T17:38:34Z")
Cool. Next, they can stop setting the “Keep me logged in” box to checked every once in a while, and stop asking me for my phone number to further “secure” my posts. ---
**Author:** ![LSLGuy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lslguy/32/5813_2.png) [@LSLGuy](https://boards.straightdope.com/u/LSLGuy)\ **Post date:** [June 4, 2015, 9:40pm UTC](https://boards.straightdope.com/t/facebook-does-something-for-privacy/721438/7 "2015-06-04T21:40:32Z")
We’re still not communicating. My fault. My point is the user will \*also \*file their \*private \*key with Facebook as part of using Facebook’s upcoming email system. In fact Facebook will probably issue them the key pair when it issues them a supposedly “inherently encrypted and secure” email address. The decryption of incoming public-key encrypted emails will be done using the private key on Facebook’s servers. Which servers will then serve a web page (over https) to the user showing the plain text of the incoming mail. And allowing Facebook to peek at the contents along the way. I predict this will be very popular with the rubes who equate “encrypted” with “secure” with no further understanding. ---
**Author:** ![Senegoid](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/senegoid/32/6606_2.png) [@Senegoid](https://boards.straightdope.com/u/Senegoid)\ **Post date:** [June 5, 2015, 9:59am UTC](https://boards.straightdope.com/t/facebook-does-something-for-privacy/721438/8 "2015-06-05T09:59:59Z")
> [@LSLGuy](#): > > My point is the user will \*also \*file their \*private \*key with Facebook as part of using Facebook’s upcoming email system. In fact Facebook will probably issue them the key pair when it issues them a supposedly “inherently encrypted and secure” email address. > > The decryption of incoming public-key encrypted emails will be done using the private key on Facebook’s servers. Which servers will then serve a web page (over https) to the user showing the plain text of the incoming mail. And allowing Facebook to peek at the contents along the way. And which, if this is correct, also puts users’ private keys at risk of being hacked, that is, of some third party hacking into Facebook’s servers and obtaining users’ keys _en masse._ Can this possibly be true? Servers and “cloud” are _not_ the places that private keys really ought to be. ETA: The _whole idea_ of private keys is that the owner of a private key should _never_ transmit that key _anywhere._ ---
**Author:** ![BigT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bigt/32/12044_2.png) [@BigT](https://boards.straightdope.com/u/BigT)\ **Post date:** [June 5, 2015, 10:40am UTC](https://boards.straightdope.com/t/facebook-does-something-for-privacy/721438/9 "2015-06-05T10:40:10Z")
What upcoming email system? Facebook killed off it’s email system last year. Now all your [facebook.com](http://facebook.com) email does is forward to your primary email account. I admit it’s a strange move, but reinstating their email program after dismantling it last year seems far more ridiculous. Plus, I’m not even sure that the forwarded emails will use PGP. Everything just refers to notifications being encrypted.