Your Facebook Pokes Are Stored For Two Days. Encryption Keys Then Deleted

http://techcrunch.com/2012/12/22/your-facebook-pokes-are-stored-for-two-days-then-their-encryption-keys-are-deleted/

by iProject • 14 years ago

23 48 14 years ago

mikegioia• 14 years ago

I'm still a little confused. It seems the "poke" is encrypted, so they encrypt the picture that's sent. But then the encryption key is deleted.

Does that mean the "encrypted photo" is deleted after 2 days, or is the photo's "identification key" (like a hash or ID) deleted after 2 days?

ConstantineXVI2• 14 years ago

They're (explicitly) deleting the key; provided they're not using ancient or horribly broken encryption, the image itself is effectively indistinguishable from gibberish. I'd assume the images themselves get deleted as well, but without a key they're worthless anyway.

pyre• 14 years ago

Sounds like the photo itself may or may not be deleted, but the keys definitely are. Though the "two days" part is a bit of a misnomer as the key backups exist for 90 days. Even if they are deleting the db copy of the photo, they probably aren't going the whole hog and clearing it out of backups,etc (as mentioned elsewhere) so this is why the keys are relevant.

sbisker2• 14 years ago

Wait, my engineer-sense is tingling. Why are they just deleting the key? If they really couldn't access the Poke after deleting the key, wouldn't they want to save storage costs by deleting the encrypted message contents too?

Unless, of course, the key isn't the only way the message can be decrypted.

CJefferson• 14 years ago

Making sure no pokes end up getting stored on a backup, or in a cache, or temporary directory, could be tricky. Having to only have one thing, stored specially, to clean out might well be easier to organise in a big already existing framework.

furyofantares• 14 years ago

A backup doesn't make sense without also backing up the key.

Caching could make sense without caching the key if the key is way smaller than the data, but why cache something that only needs to be read once?

ConstantineXVI2• 14 years ago

If the designer was particularly paranoid, they could be keeping the keys in RAM only (on machines without swap, of course). If the keys never touch disk, easier to purge them and know they're gone.

loxs2• 14 years ago

I think that they have an extremely durable/redundant data store, which is effectively "write-only". You write to some server that replicates its data to other machines, possibly in remote data centres. Read about "eventual consistency" if you are interested.

This makes it practically impossible to delete data reliably. You can never be sure whether or not "ghost" copies remain after you delete data. For example on machines that failed and went offline between the write and the delete. You can expect that such machines "eventually" will receive the delete command, but you cannot be sure. Especially as the system is designed to heavily prefer data redundancy.

I would guess that encryption itself is a "trick" to avoid having to solve the "deletion problem".

vidarh2• 14 years ago

My engineer-sense says that every item of data written is at risk of being copied into places you wouldn't think to delete them from.

Note that they are not saying they are not deleting the encrypted message contents too. What they are saying simply indicates that what they promise is that they delete the keys.

There are practical reasons to do it this way: You only need to ensure that you delete one key per user (you keep a "current" key, that is anything up to two days old, and a previous key that you delete once it reaches two days), vs. deleting a possibly much larger amount of data entries that might also be more likely to be cached all over the place.

If I were to design a system like that, I'd try to delete the contents, but assume that I'd miss something, and aim to delete the keys too. I'd probably also make at least portion of the key depend on a site-specific set of secret rolling over with time that it should be policy not to log etc. to make it even less likely that the full key would survive longer than it should.

sbisker2• 14 years ago

Agreed that that's a good reason not to promise to delete the data. However, they don't even say they'll try to delete it, do they?

Of course, "trying" is legally just a terrible way to not promise and still get sued. I get why their lawyers would want them not even mention the data itself.

Still...Facebook is not exactly trusted when it comes to the privacy of just about anything. They're trying to operate a service in the grey area between what they want to do and reality, and doing so depends heavily on people's trust in their intentions. You can guess how much I trust Facebook to keep my data private right now (if not from my timeline, then from the government, etc.)

grandpoobah• 14 years ago

Seems somewhat silly, the idea that it's difficult for a company to not store your stuff.

noblethrasher• 14 years ago

Difficult because of automatic backups, archiving, and such.

sweis• 14 years ago

Think about availability. A large web site is going to keep replicated copies of data across many geographic locations, plus backed up in long term storage. Those data are stored in hardware that is continually coming in and out of service. It's actually very hard to say with certainty that every copy of a particular piece of data has been deleted.

cma2• 14 years ago

Why should it ever be written to permanent storage?

kami8845• 14 years ago

In recent history it only really seems to be difficult for Facebook

vidarh2• 14 years ago

That's because only Facebook have seemed to be uninterested in making the data unavailable for many types, at least historically.

Don't fall into the trap of assuming that just because you don't get to see the data, that it's not stored all over the place at other companies.

white_devil• 14 years ago

Yeah, far be it from Facebook to use the pictures you post to gather personal data on you.

DanBC2• 14 years ago

> is Facebook saving these potentially embarrassing photos and videos? No. It’s deleting them. Pokes are encrypted, and Facebook deletes the encryption keys two days after they’re read so they’re unreadable. Key backups are destroyed within 90 days, making a poke completely inaccessible.

Please could someone with familiarity with English / EU law say if this is legal or not?

loxs2• 14 years ago

See my explanation here https://news.ycombinator.com/item?id=4957817

It might or might not be legal. But because of laws of physics and mathematics it's impossible for them to do it any other way.

001sky2• 14 years ago

But because of laws of physics and mathematics...

-- you mean cost/benefit.

Nothing is impossible, if one is willing to pay the price.

rmc• 14 years ago

I'm confused by your question. How is this not legal? Most of Facebook's EU legal troubles are to do with them storing too much information for too long, in breech of EU data protection law

This "deleting personal information" seems to fall within the spirit if the law

DanBC2• 14 years ago

That's Data Protection law. But some organisations have to retain data under the Data Retention (EC Regulations 2009) statutory instrument.

(http://www.legislation.gov.uk/uksi/2009/859/contents/made)

I have no idea if Facebook is covered by that law. I don't think they are, but maybe someone here knows more than I do. And maybe some groups are pushing for more organisations to retain data?

michaelhoffman• 14 years ago

Wouldn't it be trivial for the recipient to take a screenshot of the private content and therefore retain access to it for years later?

sandis• 14 years ago

App hides the content as soon as you try to take a screenshot and it notifies the sender of your attempt.

Devilboy• 14 years ago

Like any DRM this is easily defeated. I could run the app in a virtual machine and take the screenshot from the hypervisor or host machine instead. Or I can capture the network traffic. Or I can take a photo of my phone. And so on and so on.

brown9-2• 14 years ago

In iOS, an app can detect if you press the home button and lock button simultaneously to take a screenshot?

jonknee• 14 years ago

Maybe on Android, but iOS does not have the [public] APIs to allow for that. There used to be a notification called PictureWasTakenNotification that was fired after a picture was taken, but that disappeared in iOS 5.

Snapchat notifies of a screenshot, but the screenshot can still be taken. The theory is Snapchat checks the photo album count and if there's an additional photo it assumes a screenshot and will notify the other party.

Here's a discussion on the topic:

http://stackoverflow.com/questions/13484516/ios-detection-of...

audeyisaacs2• 14 years ago

Yes.

http://www.facebook.com/help/304363929683337/

runlevel1• 14 years ago

To save everyone a click:

You can take a screenshot, but it notifies the sender.

Quote:

  Can I take a screenshot of pokes I receive?  
    
  Yes. When you take a screenshot, your friend will see  
  [an icon] next to your name letting them know. While  
  pokes will disappear on the app, screenshots and photos  
  from other devices can capture your poke, so share  
  responsibly.

Edit: Fixed formatting.

rayiner• 14 years ago

What is Facebook's monetization strategy for a feature that will be used primarily for 15 year olds sending each other naked pics? I can't believe they don't have one.

captainobv• 14 years ago

I don't get the commotion. In light of the analog hole [1], isn't this whole thing with Poke's privacy/encryption just a big pointless media/PR circus?

Unless I misunderstand something here, the other party can store your data indefinitely, and no amount of DRM lockdown can really change that.

[1] http://en.wikipedia.org/wiki/Analog_hole

mooneater• 14 years ago

And we believe them... why?

recursive• 14 years ago

Am I using the same facebook? For me, pokes don't seem to contain any information other than who sent them, who the target is, and when it was sent. I know I've seen pokes older than two days. They stick around for months.

audeyisaacs2• 14 years ago

Facebook has launched a new image chat service also called Poke. It confuses me too.

"The Poke app for iPhone is a simple and fun way to say hello to your friends. You can send pokes, along with messages, photos and videos, to a friend or multiple friends at once. When you send messages, photos and videos, you can choose how long they'll be available for your friends to view up to 10 seconds. After that, they disappear from the app."

http://www.facebook.com/help/397568030328686/

Your Facebook Pokes Are Stored For Two Days. Encryption Keys Then Deleted

Related Stories