|
12345 |
- title: Securing Email Communications from Facebook
- url: https://www.facebook.com/notes/1611941762379302/
- hash_url: d33a940429324a21d8fcdb198f303b3b
-
- <p>It's very important to us that the people who use Facebook feel safe and can trust that their connection to Facebook is secure; for instance this is why <a href="https://www.facebook.com/notes/facebook-engineering/secure-browsing-by-default/10151590414803920">we run connections to our site over HTTPS</a> with HSTS and why we <a href="https://www.facebook.com/notes/protect-the-graph/making-connections-to-facebook-more-secure/1526085754298237">provide a Tor onion site</a> for people who want to enjoy security guarantees beyond those offered by HTTPS.<br/><br/>However these technologies protect only the direct connections people make to Facebook. People also receive information from us over channels such as email. Whilst Facebook seeks to <a href="https://www.facebook.com/notes/protect-the-graph/massive-growth-in-smtp-starttls-deployment/1491049534468526">secure connections to your email provider with TLS</a>, the stored content of those messages may be accessible as plaintext (with attachments) to anyone who accesses your email provider or email account.<br/><br/>To enhance the privacy of this email content, today we are gradually rolling out an experimental new feature that enables people to add <a href="http://l.facebook.com/l.php?u=http%3A%2F%2Fwww.openpgp.org%2F&h=IAQG3u7eQ&s=1" target="_blank" rel="nofollow">OpenPGP</a> <a href="https://www.facebook.com/l.php?u=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Frfc4880&h=nAQF_xisi&s=1" target="_blank" rel="nofollow">public keys</a> to their profile; these keys can be used to "end-to-end" encrypt notification emails sent from Facebook to your preferred email accounts. People may also choose to share OpenPGP keys from their profile, with or without enabling encrypted notifications.<br/><br/>You will be able to update your own public key, using a desktop browser, at:</p><p><br/></p><p><span class="photo "><img class="photo_img img" alt="" src="https://scontent-cdg2-1.xx.fbcdn.net/hphotos-xaf1/v/t1.0-9/s720x720/11391717_1612770812296397_2216033484062464781_n.png?oh=ac2279af4a594e5c13fbe31d6b24b8aa&oe=560C0141" title=""/></span><br/><br/></p><p>Where encrypted notifications are enabled, <a href="https://www.facebook.com/l.php?u=https%3A%2F%2Fpgp.mit.edu%2Fpks%2Flookup%3Fsearch%3D0x2f3898cedee958cf%26op%3Dindex&h=UAQGGza95&s=1" target="_blank" rel="nofollow">Facebook will sign outbound messages using our own key</a> to provide greater assurance that the contents of inbound emails are genuine.<br/><br/><span class="photo "><img class="photo_img img" alt="" src="https://scontent-cdg2-1.xx.fbcdn.net/hphotos-xft1/t31.0-8/s720x720/11148484_1612770885629723_423478987263214002_o.png" title=""/></span><br/></p><p><br/></p><p><b>Technology</b></p><p><b><br/></b>Created as PGP nearly 25 years ago by <a href="https://www.facebook.com/l.php?u=https%3A%2F%2Fwww.philzimmermann.com%2FEN%2Fbackground%2Findex.html&h=jAQGFiJi0&s=1" target="_blank" rel="nofollow">Phil Zimmermann</a>, OpenPGP is one of the most popular available standards for protecting email with public key encryption. If you are unfamiliar with using OpenPGP technology, the Electronic Frontier Foundation offers an introduction:</p><p>...with installation guides for:</p><p>For our implementation we have chosen to use GNU Privacy Guard - âGPGâ - a widely used and free implementation of the OpenPGP standard. Facebook is a <a href="https://www.facebook.com/l.php?u=https%3A%2F%2Fgnupg.org%2Fblog%2F20150310-gnupg-in-february.html&h=6AQFCyqOu&s=1" target="_blank" rel="nofollow">supporter of GPG</a> and we encourage others to <a href="https://www.facebook.com/l.php?u=https%3A%2F%2Fgnupg.org%2Fdonate%2Findex.html&h=vAQHpf1VO&s=1" target="_blank" rel="nofollow">support GPG</a> as well.<br/><br/><b>Key Fingerprints & Roadmap</b><br/><br/>Facebook's OpenPGP key comprises a long term primary key with short term subkeys; this allows us to frequently rotate our operational keys whilst maintaining the web of trust and a consistent identity over time. As of the time of writing our primary key has the fingerprint:<br/><br/><tt>31A7 0953 D8D5 90BA 1FAB 3776 2F38 98CE DEE9 58CF</tt><br/><br/>â¦with the following operational subkey fingerprint:<br/><br/><tt>D8B1 153C 9BE9 C7FD B62F 7861 DBF4 E8A2 96FD E3D7</tt><br/><br/>Facebook notifications are encrypted with a version of GPG that supports encryption with the RSA or ElGamal algorithms; we are investigating the addition of support for GPG's newer elliptic curve algorithms in the near future. <br/><br/>Finally: public key management is not yet supported on mobile devices; we are investigating ways to enable this.<b><br/></b></p><p><b><br/></b></p><p><b>Thanks</b><br/><br/>We would like to thank our beta-testers, including:<br/></p><ul><li>Eleanor Saitta<br/></li><li>Per Thorsheim<br/></li><li>Runa A. Sandvik<br/></li><li>Smári McCarthy<br/></li><li>Steven Murdoch<br/></li><li>Tom Lowenthal<br/></li></ul><p>â¦and others; we are most grateful for your invaluable help and insights.</p><i>Steve Weis and Zac Morris are Software Engineers for the Facebook Security team in Menlo Park; Jon Millican is a Software Engineer for Security Infrastructure at Facebook in London.</i>
|
