Facebook now supports PGP email!

In an interesting post (with the tediously link-baity headline “Facebook just made a move that will infuriate law enforcement”), Business Insider reports that Facebook will now let you add your PGP public key to your profile, and that Facebook can be configured to use that key when they send you email.

This has the potential to make Facebook much more secure: The email to reset your password will be encrypted with your public key, potentially defeating the standard attack on a social media account (hijacking an email address and then getting the site to send that address a password reset message). As long as your private key stays under your control, the attacker can’t get at the password reset URL, even if they can get at your email.

As a bonus, any email alerts from Facebook remain somewhat private. (Not that I’d share anything I wanted kept private with Facebook, or expect that anything anyone else shared with Facebook would remain private—but keeping the contents of my email private seems worth doing just for its own sake.)

Of course, as Facebook warns you, if you lose your private key and access to Facebook at the same time, you may well be completely screwed.

I think it’s a risk worth taking, and have already added my PGP key to my Facebook profile.

Vice president in charge of going to jail

During the 1970s, there was a big push to hold corporations accountable for crimes they committed. Resistance to the idea came from people who thought that any crime would be committed by specific individuals, and that those individuals, not the corporation, should be held accountable.

Activists pushing for direct criminal sanctions against corporations pointed out that the obvious tactical response by the corporations to a policy of only holding individuals accountable would be to hire a “vice president in charge of going to jail.” That person could be put in charge of whatever activities might end up being found to be illegal—and be compensated appropriately for the extra risk he was taking. (How much would they have to pay you to take a 3% chance that you might have to spend 2 to 5 years in a minimum-security prison? One hundred thousand dollars a year? A million? Ten million? Many people have their price, and it tends to be surprisingly low, at least for risks perceived as being fairly low.)

I was reminded of this in the wake of Marissa Mayer’s statements that Yahoo and other corporations were unable to reveal that they were caving in to US government pressure to turn over customer data, because they’d go to jail if they did.

What those corporations needed was a VP in charge of going to jail: Someone hired specifically to speak out if the company receives a National Security Letter—and appropriately compensated for the risk that they might have to go to jail.

Sadly, it’s tough to get the incentives right. The corporations that the 1970s activists were concerned about were engaged in things like illegal waste disposal. Their “VP in charge of going to jail” had two goals—dump the waste as cheaply as possible, while making the activity look like it might be legal. As long as it was close enough to being legal to avoid going to jail, all that extra compensation was free money—but if looking like they might be following the law wasn’t a lot cheaper than actually following the law, the board was going to figure that there was no point in employing the expensive VP.

In the case of being the VP in charge of going to jail for revealing that the company had received a National Security Letter, the extra compensation would be received in advance, when the VP wasn’t even doing anything illegal. It would be awfully tempting to pocket all that money—and then when the National Security Letter came, to say, “You know, upon reflection, I think in this case my conscience requires me to follow the law and keep quiet.”

I’ve tried to come up with some mechanism to get the incentives right. Maybe paying the extra money into a trust that pays out promptly if the VP goes to jail, but otherwise only after many years, when there’s reason to believe that there was no National Security Letter—and of course, if it turns out there was a National Security Letter and the VP didn’t speak up, the money goes to charity instead. But that has too many problems with being unenforceable due to being contrary to public policy.

It’s too bad. A VP in charge of going to jail seemed like a perfect solution.