June 2, 2015 By Shane Schick 2 min read

Sometimes social networks seem like a place where everything becomes public sooner or later, but a recently introduced Facebook notification encryption feature may provide an unusually high level of security to certain kinds of communication.

In a public note available to all its users, the company described Facebook notification encryption as an experiment of sorts that will roll out gradually, beginning on the desktop and later expanding to mobile. It involves OpenPGP, through which consumers would generate a private key only they know and a public key that would be affiliated with their Facebook account. Adding an OpenPGP to a profile by visiting the “Account” section on a profile and then editing the “Contact and Basic Info” area would mean any notifications sent to that account holder would be impossible to read without the private key.

As PC World noted, average consumers may not feel they need Facebook notification encryption for the kind of messages they get from friends and family. In some scenarios, though, the feature could help prevent hackers from taking over accounts by attempting to generate password resets. No wonder other online services such as Google’s Gmail are expected to be adding OpenPGP as a part of their security measures in the near future.

This isn’t the only area where the social network is trying to reassure consumers that it’s a service they can trust. BetaNews pointed out that besides Facebook notification encryption, the company has also recently leveraged Tor for those worried about connecting via HTTPS, along with a tool — not yet available to all users — that will periodically assess an account’s degree of vulnerability.

According to Ars Technica, Facebook notification encryption builds extra security by using not only a consumer’s private key, but adding its own on outgoing messages. For example, if a cybercriminal were to attempt a phishing scheme by impersonating the company and asking a user for credentials, it would be fairly easy to spot thanks to the lack of outbound encryption key. Overall, the move could be influential enough that OpenPGP becomes more of a standard across a range of online services that everyday people use — the kind of best practice that makes Facebook the security industry’s best friend.

More from

FYSA — VMware Critical Vulnerabilities Patched

< 1 min read - SummaryBroadcom has released a security bulletin, VMSA-2025-0004, addressing and remediating three vulnerabilities that, if exploited, could lead to system compromise. Products affected include vCenter Server, vRealize Operations Manager, and vCloud Director.Threat TopographyThreat Type: Critical VulnerabilitiesIndustry: VirtualizationGeolocation: GlobalOverviewX-Force Incident Command is monitoring activity surrounding Broadcom’s Security Bulletin (VMSA-2025-0004) for three potentially critical vulnerabilities in VMware products. These vulnerabilities, identified as CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226, have reportedly been exploited in attacks. X-Force has not been able to validate those claims. The vulnerabilities…

SoaPy: Stealthy enumeration of Active Directory environments through ADWS

10 min read - Introduction Over time, both targeted and large-scale enumeration of Active Directory (AD) environments have become increasingly detected due to modern defensive solutions. During our internship at X-Force Red this past summer, we noticed FalconForce’s SOAPHound was becoming popular for enumerating Active Directory environments. This tool brought a new perspective to Active Directory enumeration by performing collection via Active Directory Web Services (ADWS) instead of directly through Lightweight Directory Access Protocol (LDAP) as other AD enumeration tools had in the past.…

Smoltalk: RCE in open source agents

26 min read - Big shoutout to Hugging Face and the smolagents team for their cooperation and quick turnaround for a fix! Introduction Recently, I have been working on a side project to automate some pentest reconnaissance with AI agents. Just after I started this project, Hugging Face announced the release of smolagents, a lightweight framework for building AI agents that implements the methodology described in the ReAct paper, emphasizing reasoning through iterative decision-making. Interestingly, smolagents enables agents to reason and act by generating…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today