Hacker News new | ask | show | jobs
by tomjen3 4033 days ago
Yeah but there is a hell of a difference between seeing that you have received a friend request and seeing that you have received a friend request from an agency that helps victims of domestic abuse.

The first is pretty innocent, the other could get you killed.
1 comments
patzerhacker 4033 days ago
If someone is suffiently abusive and paranoid then the distinction is meaningless - they will assume that any notification they can't read is one they don't approve of, and somebody in that situation wouldn't benefit from encrypted notifications. They likely wouldn't have notifications on at all, so encrypting them doesn't make them safe to use in this situation.

That doesn't make encrypted notifications useless in general or otherwise bad, but it's an oversell to say this makes them useful for abuse victims. In fact, selling it that way is dangerous given a sufficiently abusive and motivated adversary as it's false security.

link
bigiain 4032 days ago
Sure - but we (or Facebook) need to weigh up whether doing this which may (or may not) help in some cases is of greater benefit than not doing this because in some "sufficiently abusive" cases it won't work (or may even me harmful). My gut feel is that it's a good thing, and that the benefits against "snooping grade" abuse is positive and way more common than the potential downside in "sufficiently abusive" cases. It's not a requirement that Facebook fix everything to "worst case abuser" standards before providing additional features or utility to other users of their site. (Lets face it, if your postulated "sufficiently abusive adversary" is the threat model, you've got bigger problems to solve than securing your Facebook account - and Facebook can't help you with those in general...)
link
patzerhacker 4032 days ago
It's a good thing. If the take-away from my post was that it wasn't then I'm sorry for not conveying that more up front.

Again, I'm responding to the grand-parent post that said this would be good for abuse victims. It's not all that great, but that doesn't mean it's useless.

link
tomjen3 4032 days ago
You are right. I assumed that encrypted notifications would be sufficiently common that they wouldn't raise a red flag, but that is obviously wrong.
link