Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

France’s government is building its own encrypted messenger service

reuters.com

Post reply on HN
Print view View original

61–70 of 133 posts

Re: France’s government is building its own encrypted messenger service

#61

Post by Aissen »

cm2187 wrote: post #60
Aissen wrote: post #56

Earlier quoted context omitted.

On Android (at least); you can verify that the apk is signed with the developer's key; and Signal provides reproducible builds. Then the app is designed to not trust the server. I think we are in agreement that Apple or Google could patch the app before it gets deployed. But AFAIK it has never been done yet, and if it ever happens, it would undermine all credibility of the platform. Of course a state actor wouldn't w…

Thinking about it, Google and Apple actually don't even need to patch the app, they have access to all key strokes and screen rendering. It just needs to be a few lines of code hidden anywhere.

This would need patching the OS at runtime, but yes, it's also possible.

Re: France’s government is building its own encrypted messenger service

#62

Post by icebraining »

blauditore wrote: post #40
cm2187 wrote: post #29

What’s amusing is that foreign secret services are not the only ones snooping on French politicians. French secret services have a whole department (formally called RG) in charge of collecting files on every domestic public figure (own file is a interesting ritual read for a newly promoted minister of interior). The justice dept had also an interesting interpretation of attorney client privilege where it argued recen…

> But French politicians are almost exclusively political science graduates, lawyers, doctors and teachers, not typically tech savvy. I think this applies to politicians worldwide, at least in western countries.

We have a non-insignificant number of engineers as politicians in Portugal. E.g. the current Secretary-General of the UN is one of our ex-PMs, and is an ex-assistant professor of Telecommunication Signals after having graduated in Physics and Electrical Engineering.

Considering our political panorama, I don't think this has helped much, though.

Re: France’s government is building its own encrypted messenger service

#63

Post by benevol »

nickik wrote: post #47
benevol wrote: post #15

When tax dollars go into open source, it's just an endless chain of win-win-win-win-... News like this is just great. :-)

Yeah its a total win for the french tax payer who will spend a bunch of money on a service that they neither need nor want.

Which means you already have conducted a nation-wide poll on the question?

Re: France’s government is building its own encrypted messenger service

#64

Post by coldtea »

icebraining wrote: post #59
isolli wrote: post #51

Earlier quoted context omitted.

Such a comment is meaningless without context. How often do corporate IT projects fail? How often do government IT projects fail?

How is the corporate failure rate relevant?

It is if the grandparent meant to disparage government IT projects (compared to corporate IT projects) -- which is a possible reading.

(It's also relevant because because we pay corporations with subsidies, tax cuts, tax evasion, research grants, public procurement, specialty laws favoring them, etc -- sometimes even more than we pay governments).

Re: France’s government is building its own encrypted messenger service

#65

Post by cm2187 »

Aissen wrote: post #61
cm2187 wrote: post #60

Earlier quoted context omitted.

Thinking about it, Google and Apple actually don't even need to patch the app, they have access to all key strokes and screen rendering. It just needs to be a few lines of code hidden anywhere.

This would need patching the OS at runtime, but yes, it's also possible.

What I mean is that perhaps they already have.

Re: France’s government is building its own encrypted messenger service

#66

Post by emiliobumachar »

klmr wrote: post #58
stesch wrote: post #35

Wasn't PGP illegal in France in the 1990s? Do they expect people to trust them?

> Wasn't PGP illegal in France in the 1990s? Essentially yes (and not just PGP), strong cryptography fell under arms regulations and required, essentially, the equivalent of a firearms license (but was, by contrast, almost impossible to obtain). Import and export of cryptography technology are still regulated, though [1]. > Do they expect people to trust them? I’m not sure what you mean by that: This isn’t a trust is…

The trust issue is whether to trust the French government to care about the privacy of individual citizens over its own surveillance capability towards those citizens, when it made the opposite tradeoff in the past.

Though I agree it's not as bad as if they had been caught lying on the topic. Still, are they specifically saying the tool will protect people from the government itself?

Re: France’s government is building its own encrypted messenger service

#67

Post by cm2187 »

Arathorn wrote: post #50
cm2187 wrote: post #32

Earlier quoted context omitted.

Unless you can verify the deployed build against an open source code, whether the code is open source or not is irrelevant, you trust all the intermediaries. Which is ok for a corporate actor but probably not when you are a sovereign actor and know you are dealing with a keen NSA. How could you control that Apple or Google wouldn’t patch the app before it gets deployed or after it has been deployed?

I imagine you’d run your own OS with reproduceable builds all the way down.

All the way down to the hardware manufactured in China. Life sucks for paranoid intelligence services.

Re: France’s government is building its own encrypted messenger service

#68

Post by StudentStuff »

alt678 wrote: post #54
ersiees wrote: post #3

What about using Signal? Will they do something else then using the Signal protocol? If so, this might be either pretty expensive or could go wrong.

Afaik they would still need Google Services, based in the US obviously, to run Signal. There's technically an APK on the Signal website without Gapps, but it's not officially supported by the development team. On their issue tracker they "leave it to the open source folks", i.e. ignore serious bugs like massive battery life degradation and Signal silently not updating for hours.

Thing is, you either get massive battery life degradation or your messages won't get through, there isn't much of a choice there unless you use push messaging. Google Cloud Messaging allows Signal's servers to send a "Hey, wake up and connect to us!" message to your phone, and every other app uses GCM for this as Google has spent a ton of time trying to optimize both reachability and battery life with GCM.

Maybe something will come along to supplant this, but for now push messaging is how we deal with terrible state table problems at the cell network operator level without wrecking battery life.

Re: France’s government is building its own encrypted messenger service

#69

Post by matthewmacleod »

skocznymroczny wrote: post #30
edhelas wrote: post #6

Well looks like our government (I'm French) is having the NIH syndrome as well. Why not reusing existing solutions like XMPP + OMEMO? They can invest a few thousands euros in those projects and in a couple of open source clients. Plus this will also allow the citizen to have a nice, government funded, encrypted solution. But hey, it's not "sexy" enough. So they'll drop some public money to a big company that knows "w…

Because it's not about building an encrypted solution, it's about building "our" encryption solution, so that we can break it when needed and infringe on privacy of citizens. Western European countries are going full speed ahead on censorship and surveillance, so no wonder they are trying to fight 'pesky' foreign encryption schemes.

This is a boring middlebrow dismissal. Please provide some evidence, or shut the hell up.
Post reply on HN