Messenger finally gets end-to-end encryption for all chats

This week, Meta announced that it is moving closer to end-to-end encryption (E2EE) on all of its messaging platforms, including Messenger and Instagram.

WhatsApp has had E2EE since 2016, so those who use Meta’s other apps to chat have had to wait a very long time for Messenger and Instagram to catch up.

E2EE is important because it means your messages are always encrypted: first on your device, on their way to the other person’s device, and remain encrypted on all web servers.

Without E2EE, your messages should still be encrypted when sent to the recipient, but may be vulnerable if the servers they are stored on are hacked, or even viewed by employees who have access to the server.

Meta said on Tuesday that it had “begun to gradually expand default end-to-end encryption testing for Messenger.” In other words, you do not have to register to benefit from it: it happens automatically.

As to when you can expect to see a notification that your Messenger chats have E2EE, Meta said the process will be relatively slow and it will be activated randomly.

“Over the next few months, more and more people will continue to have some of their chats gradually upgraded with an extra layer of protection provided by end-to-end encryption. We will notify users of these individual threads as they are updated. We know people will have questions about how we select and update individual threads, so we wanted to clarify that this is a random process. It is designed to be random so that there is no negative impact on our infrastructure and people’s chat experience. It also ensures that our new end-to-end encrypted threads continue to provide users with a fast, reliable, and rich experience on Messenger.

“Creating a secure and resilient end-to-end encrypted service for the billions of messages sent every day on Messenger requires careful testing. We will provide updates as we progress towards this goal during 2023.”

Considering that E2EE has been available for group chats and calls on Messenger for almost a year, you’d be forgiven for wondering why it took so long for it to be fully rolled out by default for all chats, including between individuals.

The simple fact is that it is not simple to do so. You might assume that Meta owns Facebook, WhatsApp, and Instagram, it can just take WhatsApp’s encryption and lock it down to the other services. Unfortunately, it doesn’t work that way, and it takes a lot of work.

It’s not just messages that need to be encrypted, either. All the media you send: photos, voice recordings, videos, GIFs, must also be encrypted.

Meta said it is now adding more features to encrypted chats, including custom emojis and reactions, chat themes, link previews, group profile pictures, Android chat bubbles and active status, so people can see when you’re using Messenger.

Although he didn’t say so, we expect the usual E2EE flaws to exist in Messenger – and possibly Instagram – so it’s always worth keeping them in mind rather than assuming that everything you send to someone is completely private.

One of them is the fact that the recipient can take screenshots, photos or videos of the conversation and share them with anyone. They might also be able to report it to Meta the same way WhatsApp users can if they “report” a message sent to them. This is forwarded to WhatsApp moderators who can read it.

However, that’s not to say that E2EE isn’t a valuable feature to have. It was only in August last year that a 17-year-old and her mother were prosecuted for having an abortion when a court ordered Facebook to hand over the messages they had sent. These were then used as the basis for a search warrant where laptops and phones were seized containing much more data.

If the Messenger chat had been encrypted with E2EE, it would not have been possible for Meta, a court or anyone to read what was said.

Of course, that’s the downside of E2EE: it provides privacy for everyone, whether they’re having an innocent conversation or planning a crime.

Meta is also slowly rolling out E2EE to Instagram. Currently, it’s available in a few countries, including Russia and Ukraine, and isn’t the default: you need to tap the padlock icon next to Start end-to-end encrypted chat. You can find out more on Meta’s blog.