Configuring PGP Encrypted Facebook Notifications

Facebook isn’t synonymous with privacy by any stretch of the imagination. But for some reason, they decided to add a feature that allows for military grade encryption of email notifications. Facebook accepts any OpenPGP implementation to use the feature. PGP was created by Phil Zimmerman. You can learn more about the creation in my article here.

In short, PGP is a symmetric-key encryption system. The software generates a unique public and private key based on a secret password inputted and some customization on the level of cryptographic strength you prefer during generation.

Once the keys are generated, you can distributed your public key to other individuals. They can encrypt a secret text, file, or email with your public key. Once it is encrypted the only person that decrypt it is you. Once you receive the encrypted file, you can use your secret passphrase and private key to decrypt it for viewing. This is vice versa for any individual you wish to communicate with. Encrypted a file with their public key so it cannot be viewed by taps the internet, network, or possible machine. It is completely safe until it is opened by the receiver.

A feature like this shouldn’t go to waste so its time to implement it. We will need to install some OpenPGP software, create our keys, upload them to Facebook and confirm that everything worked out correctly.

Creating the PGP public and secret key

We need to install GNU Privacy Guard, which is a free and complete implementation of OpenPGP. You can try other routes but GPG is considered an industry standard so it’s better to stick to what most people trust for proper encryption.

Install with your operating system’s package manager.

Windows user’s not familiar with Chocolately, install procedure here.

# windows with Chocolately
choco install gnupg

# Linux 
sudo <apt|apt-get|dnf|pacman> install gnupg2

# OSx with Homebrew
homebrew gnupg

With GNU Privacy Guard installed, time to create your first PGP public and corresponding secret key to start receiving encrypted notifications from Facebook.

To generate your keys, fire off the following GPG command.

gpg --full-generate-key

When you follow the key generation dialog, make sure you:

Use RSA\RSA for your encryption algorithm.
Make sure your RSA keys are 4096 bits in length
Make sure you have a ~52 character password for your secret key.

Once you have generated your keys, export the public key to upload to Facebook.

gpg --armor --output public-key.gpg --export <email>

Open up the file and it should look something like this.

Adding the public key to Facebook

Now go to Settings -> Security and Login -> Advanced -> Encrypted notification emails.

Once you reach this page, you can copy and paste your public key into the text box.

Check the box that says “Use this public key to encrypt notification emails that Facebook sends you?” Then save changes.

Decrypting the confirmation email and confirming the process

Once you have save changes from the last steps, you will get a maiden voyage email from Facebook confirming the encrypted notification emails are now working correctly by confirming a link.

We can now download the encrypted.asc attachment from the email and decrypt the notification with GPG. Back to the command line to decrypt the .asc file to see our notification. Output the file as an HTML file so you don’t have to read the HTML code in the notification. A browser renders it just fine. Have your secret passphrase you entered while creating the public and secret key ready as it is used during the decryption process.

gpg --output encrypted.html --decrypt encrypted.asc

Open up the outputted html file that was decrypted in a browser by double clicking on the file. You will get this conformation page for you to verify by clicking on a link they specify.

This link will take you back to Facebook and confirm that encrypted email notifications are working. Note that all account recovery emails will be encrypted as well.

Exporting our OpenPGP keys

Since our account recovery emails are encrypted, it has it’s pros and cons. Theoretically, only us will have the private key to decrypt the notification if our email is compromised. Especially a password change process. A decent defense in depth approach. However, that means losing the keys could lock ourselves out completely. To outweigh the drawbacks we can export our public and secret keys to upload to a cloud server or a USB key to store away in a safe. To export the keys, enter the following commands. You will need your secret passphrase to export the private key so have that accessible.

gpg --output public-pgp.key --armor --export <email>
gpg --output private-pgp.key --armor --export-secret-key <email>

Conclusion

Obviously, this isn’t for everyone. Most people are not going to be bothered in the steps to configure the encryption. This is mostly geared to encryption advocates, or high profile individuals that having a major Facebook compromise would be a huge liability. It’s work highlighting that this feature is here if this level of security is what you need for your environment.

Bonus

If command line encrypting and decrypting isn’t your thing or isn’t scalable with a large amount of Facebook notifications there are some decent plugins you can integrate into your email client.

Enigmail for Thunderbird and Postbox
PGP4Win for Window’s Outlook

michael rinderle

Michael has been a professional in the information technology field for over 20 years, specializing in software engineering and systems administration. He studied network security and holds a software engineering degree from Milwaukee Area Technical College with thousands of hours of self-taught learning as well. He mainly writes about technology, current events, and coding. Michael also is the founder of Sof Digital, an U.S. based software development Firm. His hobbies are archery, turntablism, disc golf and rally racing.