this post was submitted on 27 Jan 2026
853 points (99.7% liked)
Technology
79355 readers
4287 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
There is a distinct difference between not having end to end encryption, and bypassing it.
If you can bypass it in the middle it is by definition not end to end encryption. The entire point of end to end encryption is that only the endpoints are able to decrypt the messages and everyone in between only has access to the encrypted messages. If that's not the case that's just normal encryption not end to end.
I think we're dealing with weasel lawyer words here. Meta can boast that messages E2E encrypted between you and the recipient, but that implies nothing about key storage or security, or about other channels through which the app could send message data before it is encrypted. It may be E2EE between you and the recipient, and also sent in plaintext to Meta. Plus E2EE of messages implies nothing about message metadata.
Your device is an endpoint, it's leaking the information to Meta, that isn't a MITM.
Unless you redefine the end in e2e to mean your eyes, it's still e2e encrypted.
Bypassing means it is not an end to end encryption. It is end to MITM; and MITM to end encryption. Where the man-in-the-middle is alleged to be Meta in this case.
MitM: Meta-in-the-Middle
JFC can nobody on Lemmy read?
The bypass is happening on your device, there is no MITM.
it is not. meta controls the keys. that’s how they’re accessing the messages
the article says they can access any message, from any user, from any time period, even deleted, instantly
to make this a client-side exploit would mean that messages would need to be constantly sent in the clear (not targeted per user) for years now… and someone would have noticed that
we know meta holds the encryption keys: that’s a known fact… it’s much much easier for them to simply decrypt everything they store
How?