What is the best Matrix/Riot Android app right now? I see Riot only has 50k downloads which I'm not sure if is a mistake or reality.
France’s government is building its own encrypted messenger service
111–120 of 133 posts
Re: France’s government is building its own encrypted messenger service
#112Well looks like our government (I'm French) is having the NIH syndrome as well. Why not reusing existing solutions like XMPP + OMEMO? They can invest a few thousands euros in those projects and in a couple of open source clients. Plus this will also allow the citizen to have a nice, government funded, encrypted solution. But hey, it's not "sexy" enough. So they'll drop some public money to a big company that knows "w…
XMPP is legacy, and rightfully so. With it, by default, communication is in cleartext, there is no way to ensure message reliability and integrity without privacy implications, and multi-device support is arkward.
That's why OP said "XMPP + OMEMO".
Re: France’s government is building its own encrypted messenger service
#113Earlier quoted context omitted.
> Wasn't PGP illegal in France in the 1990s? Essentially yes (and not just PGP), strong cryptography fell under arms regulations and required, essentially, the equivalent of a firearms license (but was, by contrast, almost impossible to obtain). Import and export of cryptography technology are still regulated, though [1]. > Do they expect people to trust them? I’m not sure what you mean by that: This isn’t a trust is…
Wait a minute, does this means what I have done with Monocypher¹ is illegal? I live in France, and I clearly provided and exported "cryptographic means", and I haven't written a word to our prime minister. Same goes for Libsodium by the way, I doubt Franck Denis bothered to ask permission as well. [1]: https://monocypher.org
As far as I understand (I haven’t lived in France since 2004), the import and export restrictions are essentially unenforced, and nobody cares (as long as you’re not actively trading with embargoed nations). But if you’re working in cryptography, it might be worth talking to other local experts. There are surely user groups that know the legal situation inside out — at the very least, publicly funded researchers should be able to point you to resources.
Re: France’s government is building its own encrypted messenger service
#114Earlier quoted context omitted.
you simplify the ux (eg autodiscovering the right homeserver); hook it up to directory services and/or SSO; simplify the e2e crypto UX; change the logo and branding, and have a basis to build on for whatever future custom features they need.
were doing exactly that at the place i work at, riot has too many settings and can be quite hard for a "normal" user (someone who is used to slack for example). would love some kind of integration with openid connect though, since that would enable us to easier integrate with our AD. of course we could make that ourselves but we dont have the manpower right now.
It has (or at least had, when I ran a server) support for CAS. JASIG CAS isn’t that difficult to set up against AD, I think Shibboleth has a plug-in that implements the protocol too.
Re: France’s government is building its own encrypted messenger service
#115This is awesome to see! My only wish was that matrix and riot were clearly mentioned. This would have significantly raised the profiles of both projects that I'm a big fan of.
To @Arathorn and any other members of matrix and riot teams, kudos on this news, and great job! Next step - of course, beyond the tech work already being done on the platforms - is to promote the heck out of this news!! ;-)
EDIT: Ok, there's at least some other promotion elsewhere which mentions matrix and riot; cool: https://www.tomshardware.com/news/france-alternative-whatsap...
Re: France’s government is building its own encrypted messenger service
#116The spin here is funny. The article pretends this is done to prevent eavesdropping, while it is probably closer to the truth that this is done to ensure eavesdropping by the DGSI.
If you're talking about the metadata, yes, probably. It 's the same kind of eavesdropping capability you'd have from Signal servers (i.e: not much). Also: from what we've seen of Macron's team, they've proven that they have good-enough internal technical advisors; so it remains to be seen if they'd use a solution that can be eavesdropped.
> (i.e: not much).
Not sure if I'm 100% right here, but knowing all my contacts and when I communicate with whom is an awful much.
Re: France’s government is building its own encrypted messenger service
#117This isn’t a case of NIH; France has adopted Matrix for the project, which is a lightweight fork of Riot.im combined with a large private federation of Matrix servers. The whole thing is open source (although not public yet, as it is very early days) and open standards based. At Matrix.org we’ve been providing some support to them :) It’s very exciting to see open government projects which actually grok open source a…
Is Matrix planning to use MLS for interop with other E2E systems?
Re: France’s government is building its own encrypted messenger service
#118What is the best Matrix/Riot Android app right now? I see Riot only has 50k downloads which I'm not sure if is a mistake or reality.
Asking for "the best" might be a bit subjective, no? Early on, the Matrix Console Android client was ok; i had no problems with it. Though i think it was intended merely as a reference implementation. The Riot client (it used to be called Vector client) gained alot of attention since the beginning, so its got plenty more polish. I honestly have not used any of the other clients - since happily sticking with Riot (web client). But the matrix.org site does have a list of clients/apps (and the list is much longer than I recall since the last time I checked): https://matrix.org/docs/projects/try-matrix-now.html You lose nothing in giving a few of them a try. Cheers!
Re: France’s government is building its own encrypted messenger service
#119This isn’t a case of NIH; France has adopted Matrix for the project, which is a lightweight fork of Riot.im combined with a large private federation of Matrix servers. The whole thing is open source (although not public yet, as it is very early days) and open standards based. At Matrix.org we’ve been providing some support to them :) It’s very exciting to see open government projects which actually grok open source a…
I would've liked better if they'd gone to extend XMPP clients to do audio/video, but this is ok as well.
jitsi does this.
Re: France’s government is building its own encrypted messenger service
#120Earlier quoted context omitted.
If you're talking about the metadata, yes, probably. It 's the same kind of eavesdropping capability you'd have from Signal servers (i.e: not much). Also: from what we've seen of Macron's team, they've proven that they have good-enough internal technical advisors; so it remains to be seen if they'd use a solution that can be eavesdropped.
> (i.e: not much). Not sure if I'm 100% right here, but knowing all my contacts and when I communicate with whom is an awful much.
> Not sure if I'm 100% right here, but knowing all my contacts and when I communicate with whom is an awful much.
Signal actually doesn't know all your contacts - you can check the source code to confirm that it doesn't know about any contacts that you don't message using Signal, for example.
Signal also doesn't store most of the metadata that it could, so it really knows incredibly little about its users. It knows (for example) the last date that it was able to talk to a particular device, but they don't store historical data for that, so if you received a message on Signal today, they don't (anymore) know that they sent you a message yesterday, or last month.
Of course, that second part all runs server-side, so you do have to trust Signal when they describe their internal architecture. But to be frank, who do you trust more with that metadata: Moxie Marlinspike, or the government that is essentially the "sixth eye" in the Five Eyes alliance[0]?
[0] https://www.defensenews.com/global/europe/2018/02/05/french-...