Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

France’s government is building its own encrypted messenger service

reuters.com

Post reply on HN
Print view View original

51–60 of 133 posts

Re: France’s government is building its own encrypted messenger service

#51

Post by isolli »

Davidbrcz wrote: post #2

Comment from a French insider: It will not work. The last two IT projects the government ordered I have in mind are the ears dropping facility for the police and SAIP, an application to warn citizens in case of a dramatic event such as a terrorist attack. Both are failures. On the first one, the police complains of crashes, slowness, and not fulfilling its missions. The second simply does not warn people when there i…

Such a comment is meaningless without context. How often do corporate IT projects fail? How often do government IT projects fail?

Re: France’s government is building its own encrypted messenger service

#52

Post by reeedom »

draugadrotten wrote: post #26

The spin here is funny. The article pretends this is done to prevent eavesdropping, while it is probably closer to the truth that this is done to ensure eavesdropping by the DGSI.

Hahahaha. My sides.

Macron is hawkish about surveillance, despite public appearances. Long term, they want everything.

I think the main idea now is: let’s make it appear trusted, and see who signs up.

End to end encrypted is no good if there are side channel attacks to get your keystrokes, like from say, closed source radio firmware zero days.

Re: France’s government is building its own encrypted messenger service

#53

Post by sl956 »

ArmandGrillet wrote: post #34

I wish I would have seen a GitHub repo opened by the French government (à la Keybase) instead of an article from Reuters telling me that 20 officials beta-test an app developed by "we don't know who" using the taxes that pay my parents and friends. Show, don't tell.

https://github.com/dinsic-pim

Re: France’s government is building its own encrypted messenger service

#54

Post by alt678 »

ersiees wrote: post #3

What about using Signal? Will they do something else then using the Signal protocol? If so, this might be either pretty expensive or could go wrong.

Afaik they would still need Google Services, based in the US obviously, to run Signal.

There's technically an APK on the Signal website without Gapps, but it's not officially supported by the development team. On their issue tracker they "leave it to the open source folks", i.e. ignore serious bugs like massive battery life degradation and Signal silently not updating for hours.

Re: France’s government is building its own encrypted messenger service

#55

Post by tajen »

draugadrotten wrote: post #26

The spin here is funny. The article pretends this is done to prevent eavesdropping, while it is probably closer to the truth that this is done to ensure eavesdropping by the DGSI.

Yup. As a French citizen I’d trust a Chinese servicr more than a Franch one. Sure they evedrop more, but at least they’re less connected with French politics.

Re: France’s government is building its own encrypted messenger service

#56

Post by Aissen »

cm2187 wrote: post #32
Aissen wrote: post #28

Earlier quoted context omitted.

If you're talking about the metadata, yes, probably. It 's the same kind of eavesdropping capability you'd have from Signal servers (i.e: not much). Also: from what we've seen of Macron's team, they've proven that they have good-enough internal technical advisors; so it remains to be seen if they'd use a solution that can be eavesdropped.

Unless you can verify the deployed build against an open source code, whether the code is open source or not is irrelevant, you trust all the intermediaries. Which is ok for a corporate actor but probably not when you are a sovereign actor and know you are dealing with a keen NSA. How could you control that Apple or Google wouldn’t patch the app before it gets deployed or after it has been deployed?

On Android (at least); you can verify that the apk is signed with the developer's key; and Signal provides reproducible builds. Then the app is designed to not trust the server.

I think we are in agreement that Apple or Google could patch the app before it gets deployed. But AFAIK it has never been done yet, and if it ever happens, it would undermine all credibility of the platform. Of course a state actor wouldn't want to be the first to find out.

Re: France’s government is building its own encrypted messenger service

#58

Post by klmr »

stesch wrote: post #35

Wasn't PGP illegal in France in the 1990s? Do they expect people to trust them?

> Wasn't PGP illegal in France in the 1990s?

Essentially yes (and not just PGP), strong cryptography fell under arms regulations and required, essentially, the equivalent of a firearms license (but was, by contrast, almost impossible to obtain). Import and export of cryptography technology are still regulated, though [1].

> Do they expect people to trust them?

I’m not sure what you mean by that: This isn’t a trust issue, the French government is/was completely upfront about these restrictions.

[1] https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFT...

Re: France’s government is building its own encrypted messenger service

#59

Post by icebraining »

isolli wrote: post #51
Davidbrcz wrote: post #2

Comment from a French insider: It will not work. The last two IT projects the government ordered I have in mind are the ears dropping facility for the police and SAIP, an application to warn citizens in case of a dramatic event such as a terrorist attack. Both are failures. On the first one, the police complains of crashes, slowness, and not fulfilling its missions. The second simply does not warn people when there i…

Such a comment is meaningless without context. How often do corporate IT projects fail? How often do government IT projects fail?

How is the corporate failure rate relevant?

Re: France’s government is building its own encrypted messenger service

#60

Post by cm2187 »

Aissen wrote: post #56
cm2187 wrote: post #32

Earlier quoted context omitted.

Unless you can verify the deployed build against an open source code, whether the code is open source or not is irrelevant, you trust all the intermediaries. Which is ok for a corporate actor but probably not when you are a sovereign actor and know you are dealing with a keen NSA. How could you control that Apple or Google wouldn’t patch the app before it gets deployed or after it has been deployed?

On Android (at least); you can verify that the apk is signed with the developer's key; and Signal provides reproducible builds. Then the app is designed to not trust the server. I think we are in agreement that Apple or Google could patch the app before it gets deployed. But AFAIK it has never been done yet, and if it ever happens, it would undermine all credibility of the platform. Of course a state actor wouldn't w…

Thinking about it, Google and Apple actually don't even need to patch the app, they have access to all key strokes and screen rendering. It just needs to be a few lines of code hidden anywhere.
Post reply on HN