Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EU Commission to staff: Switch to Signal messaging app

politico.eu

Post reply on HN
Print view View original

61–70 of 289 posts

Re: EU Commission to staff: Switch to Signal messaging app

#61

Post by heartbeats »

fmajid wrote: post #60
Zenst wrote: post #11

I'm supprised they have not developed their own or at least, bankrolled the development of one via grants. Though it would be good if there was an open source communications platform that would allow the public to engage with politicians in a formal and constructive way. Alas, so much disparity in solutions that it often irks me. https://ec.europa.eu/digital-single-market/en/projects Be great if the interface was bet…

This is for communications to outsiders, who can't be expected to have an EU-internal app installed on their devices. Signal is reasonably widespread, and probably the best such messaging platform out there, although it has serious issues like the requirement for a phone number.

So why couldn't the EU fund the development of a Signal fork that doesn't need phone numbers?

Re: EU Commission to staff: Switch to Signal messaging app

#62

Post by cpach »

jariel wrote: post #28

The EU budget is 148 Billion Euros. Surely, if they have a requirement for a secure communication app, they have the wherewithal to build one for their needs, that EU citizens and others could then use if they so chose? Essential knowledge is definitely public. This is not about 'Signal' it's about why governments can't/won't deliver on so many issues they themselves deem to be very materially important to them, part…

As a citizen of a EU member state I would rather see them use Signal than try to come up with their own solution.

It is true that they could throw a lot of money on the problem. But that in itself does not guarantee that they outcome would be a world-class communication system. So given that Signal already exists and is the gold standard for secure communications, IMHO it’s better to use that.

What the EU can do however is to fund cryptography research. (And it would not surprise me if they already do.)

Re: EU Commission to staff: Switch to Signal messaging app

#63

Post by 317070 »

heartbeats wrote: post #61
fmajid wrote: post #60

Earlier quoted context omitted.

This is for communications to outsiders, who can't be expected to have an EU-internal app installed on their devices. Signal is reasonably widespread, and probably the best such messaging platform out there, although it has serious issues like the requirement for a phone number.

So why couldn't the EU fund the development of a Signal fork that doesn't need phone numbers?

We had 14 standards. With glorious government funding we make one standard to replace them all. We will have 15 standards.

Forking a piece of software whose market moat is 100% network effects is not easy.

Re: EU Commission to staff: Switch to Signal messaging app

#64

Post by cpach »

heartbeats wrote: post #61
fmajid wrote: post #60

Earlier quoted context omitted.

This is for communications to outsiders, who can't be expected to have an EU-internal app installed on their devices. Signal is reasonably widespread, and probably the best such messaging platform out there, although it has serious issues like the requirement for a phone number.

So why couldn't the EU fund the development of a Signal fork that doesn't need phone numbers?

In theory, they could. But IMHO it would not be wise to overestimate the EU’s competence when it comes to purchasing software projects and writing a sane requirement specification.

As a citizen within EU I would rather see them donate money to the Signal Technology Foundation instead. OTOH that could be controversial, so perhaps it would be better if citizens and companies would donate directly instead.

Re: EU Commission to staff: Switch to Signal messaging app

#65

Post by sschueller »

This is a mistake. They should at least compile their own version and not something that comes from an US based app store under US law. At any point the US can force a change.

This is as secure as purchasing a machine from Crypto AG. [1]

[1] https://en.wikipedia.org/wiki/Crypto_AG

Re: EU Commission to staff: Switch to Signal messaging app

#66

Post by cpach »

sschueller wrote: post #65

This is a mistake. They should at least compile their own version and not something that comes from an US based app store under US law. At any point the US can force a change. This is as secure as purchasing a machine from Crypto AG. [1] [1] https://en.wikipedia.org/wiki/Crypto_AG

Perhaps a better idea would be to fund an audit of the Signal app. (Or has that been done already?)

Re: EU Commission to staff: Switch to Signal messaging app

#67

Post by lorenzhs »

hestefisk wrote: post #51

I know Signal is secure and all — and I use it myself — but I can’t help but think how can we trusted that the central servers aren’t wiretapped? It would be the ultimate proof of security if one could transparently verify that the middle man is running the actual code it claims to be running.

This is possible with remote attestation. See the "Trust but verify" paragraph in https://signal.org/blog/private-contact-discovery/ and also https://signal.org/blog/secure-value-recovery/.

Re: EU Commission to staff: Switch to Signal messaging app

#68

Post by thu2111 »

hestefisk wrote: post #51

I know Signal is secure and all — and I use it myself — but I can’t help but think how can we trusted that the central servers aren’t wiretapped? It would be the ultimate proof of security if one could transparently verify that the middle man is running the actual code it claims to be running.

Signal uses Intel SGX to give you some assurances about this, at least for parts of their serving stack. You can run the remote attestation tools and get a report back from Intel that says, in effect, "you connected to a genuine CPU and it's running software with this hash". Then you reproduce the build of the open source code and check the hashes match.

I'd be surprised if anyone has ever actually done this. It's a very obscure thing. But to their credit, it's possible.

SGX can't actually make you have secure end to end encryption though. The Signal protocol is necessary but not sufficient. The operators can always just push a software update that invalidates all the security guarantees. It's been a problem since the start but they never talk about fixing it, even though the issue is a glaringly obvious one.

What they could do is allow third parties to audit their software updates, and then cross-sign the binaries. Android allows this but there's no UI for it. It'd benefit from a collaboration with Google to allow multi-vendor apps.

After that comes sandboxing. Dalvik/ART doesn't support the Java SecurityManager API. However, for sandboxing software components cheaply it's hard to beat. If a component is sandboxed in a correct manner then the audit costs get much lower. You don't need to re-audit a component that's changed if the sandbox means it can't access keys or message data, for example (and if everything is memory safe: you'd have to do multi-process on iOS which is a lot more expensive).

Re: EU Commission to staff: Switch to Signal messaging app

#69

Post by Blaiz0r »

sschueller wrote: post #65

This is a mistake. They should at least compile their own version and not something that comes from an US based app store under US law. At any point the US can force a change. This is as secure as purchasing a machine from Crypto AG. [1] [1] https://en.wikipedia.org/wiki/Crypto_AG

It's not as though staff will be installing it from the App store on their phones.

Re: EU Commission to staff: Switch to Signal messaging app

#70

Post by growse »

heartbeats wrote: post #61
fmajid wrote: post #60

Earlier quoted context omitted.

This is for communications to outsiders, who can't be expected to have an EU-internal app installed on their devices. Signal is reasonably widespread, and probably the best such messaging platform out there, although it has serious issues like the requirement for a phone number.

So why couldn't the EU fund the development of a Signal fork that doesn't need phone numbers?

Why would anyone trust a fork of Signal?
Post reply on HN