Facebook has announced a new ‘experimental’ feature that allows End-To-End encrypted notification emails from the social giant to user accounts. Facebook is using OpenPGP, which it says is “one of the most popular available standards for Protecting Email with Public-key Encryption.” That means Facebook can scramble communications it sends so that only you can read them. Facebook now lets users to add OpenPGP public keys to their profile, and to sign up for encrypted Facebook notifications.
While Facebook lets you add a PGP public key to your profile and check a box to receive encrypted notification emails, you will need to use a separate program to generate the key. Facebook uses GNU Privacy Guard (GPG), a widely used and free implementation of the OpenPGP standard, for its own public key and recommends the GPG Suite for Mac and Gpg4win for Windows 10.
Facebook Introduces PGP Encryption: Secure Messages, Emails, Notifications with Private key
PGP, or Pretty Good Privacy, is a program that lets people encrypt and decrypt emails, and allows users to authenticate messages with digital signatures. Facebook can scramble communications it sends so that only you can read them. However, the tool has its limits; any message you send to another user on Facebook will remain unencrypted. While only safeguarding emails sent to you from Facebook seems like small potatoes, it could have a potentially big impact. For instance, a hacker that broke into your email could previously reset your password by sending a link. Now, however, the encryption would prevent them from doing so.
You will also need to set up and manage your public key via a desktop browser. Facebook states “public key management is not yet supported on mobile devices; we are investigating ways to enable this.” After you generate your public and private keys, head to Facebook and navigate your way to the Contact and Basic Info section of your About page (or Click here).
contact-and-basic-info in Facebook
There you will need to click on Add a public key and copy and paste the text block of your PGP public key, starting with: —–BEGIN PGP PUBLIC KEY BLOCK—– and including —–END PGP PUBLIC KEY BLOCK—– at the end. (On a Mac, I exported my public key as a plain-text ASC file from the GPG Keychain application that I was then able to open in TextEdit to copy the text block mentioned above.)
How to make Facebook send you encrypted notification emails
After that, you can check the box for Use this public key to encrypt notification emails that Facebook sends you. If you check the box, Facebook will send you an encrypted verification email that you must decrypt before it will begin sending you encrypted notification emails. Once you have entered your public key and decided on the checkbox for encrypted notification emails, click Save Changes.
Facebook send you encrypted notification emails
Facebook then displays the 40-digit fingerprint of your public key on your About page, which is shorthand for the giant block of text you entered. After you decrypt Facebook’s verification email and click its included link, a new tab opens in your browser with this message, letting you know encrypted notification emails are enabled.