Facebook Can Now Send Notification Emails With End-to-End Encryption

Facebook has announced a new 'experimental' feature that allows end-to-end encrypted notification emails from the social giant to user accounts. Facebook is using OpenPGP, which it says is "one of the most popular available standards for protecting email with public key encryption."

The new feature is targeted to enhance the security of emails sent by Facebook to its users, including notifications about messages, password changes, and other notifications related to the user's Facebook account. The company believes that encryption will help ensure no one but the user can intercept the messages without the keys.

The new experimental feature is rolling out to users and allows Facebook users to add OpenPGP public keys to their profile. Users can opt-in to get encrypted notifications from Facebook. The feature can be found in the "About Me" section of Facebook profile. Notably, the Facebook's implementation of end-to-end encryption via OpenPGP public keys is accessible in India, and users can add a public key to their profile. Users can download OpenPGP-compliant tools from Gnu's Privacy Guard pageto generate their own PGP keys.

Facebook users will see a message reading, "Use this public key to encrypt notification emails that Facebook sends you?" The social platform explains the usage of OpenPGP public keys and notes, "If you check this box, you will receive an encrypted verification email to make sure that you can decrypt notification emails that have been encrypted with this public key. If you are able to decrypt the verification email and click the provided link, Facebook will begin encrypting notification emails that it sends to you with your public key."

Announcing the rollout, Facebook says, "Where encrypted notifications are enabled, Facebook will sign outbound messages using our own key to provide greater assurance that the contents of inbound emails are genuine."

The company in a post also revealed that the public key management is not yet supported on mobile devices and Facebook is investigating ways to enable this.

The new OpenPGP public keys feature is expected to work in conjunction with Facebook's earlier rollout of Tor onion site for people, which provided a way to access Facebook through Tor without losing the cryptographic protections (such as IP address and service provider). Combined with the OpenPGP encryption, and Facebook could also be used as a tool for activists in totalitarian states.

Last year, Facebook in a bid to keep users account safe, created an automated service that monitored the web for stolen email addresses and passwords.