Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EU Commission to staff: Switch to Signal messaging app

politico.eu

Post reply on HN
Print view View original

101–110 of 289 posts

Re: EU Commission to staff: Switch to Signal messaging app

#101

Post by dependenttypes »

pergadad wrote: post #90
tadzik_ wrote: post #49

Earlier quoted context omitted.

Signal app is also canonically distributed by Google Play/Apple Store, which are US entities under US law. When push comes to shove, an app update may get distributed to select individuals that will happily gather and send all their conversation histories and more. As an EU citizen, I'm half puzzled and half horrified at how happy the EU institutions are to rely on foreign products: especially coming from a country t…

What's the alternative? Private closed-source apps like Threema? This also is not for official communication , it's just for any case where staff would currently use WhatsApp or similar spyware.

I do not think that anyone suggest to use proprietary alternatives. Instead it seems that the posters in this thread would be more happy if the EU was more independent from the US by for example hosting their own signal servers and forking the client.

Re: EU Commission to staff: Switch to Signal messaging app

#102

Post by imtringued »

tadzik_ wrote: post #49
cpbotha wrote: post #29

Earlier quoted context omitted.

Signal servers only know who talked to whom, but otherwise are physically not able to see even a smattering of the contents of the communication. Correction: The signal servers don't even have that bit of metadata. See [1], they only store the last time that a user connected to the server. [1] https://en.wikipedia.org/wiki/Signal_(software)#Servers

Signal app is also canonically distributed by Google Play/Apple Store, which are US entities under US law. When push comes to shove, an app update may get distributed to select individuals that will happily gather and send all their conversation histories and more. As an EU citizen, I'm half puzzled and half horrified at how happy the EU institutions are to rely on foreign products: especially coming from a country t…

Under your threat model no internet connected smartphone is safe. Google can just push any arbitrary software to run on your phone and this includes spyware created by governments.

Re: EU Commission to staff: Switch to Signal messaging app

#103

Post by WinonaRyder »

teekert wrote: post #2

But what should I use if I am a politician and fundamentally believe that the government should be able to read my communications?

Dumb question: is your comment meant to be sarcastic? I initially read it as such but now I'm not sure, given all the other replies.

Re: EU Commission to staff: Switch to Signal messaging app

#104

Post by throwawaylolx »

pergadad wrote: post #84
Arbalest wrote: post #72

That's a tad unfortunate. Signal was just low profile enough that my wife and I could use it in China. This raises the profile of it just a bit higher than I'd like. Further, with the likes of https://news.ycombinator.com/item?id=22202110 having a higher profile makes the organisation more vulnerable to harassment from the government.

That's a pretty selfish view. On the other hand such a serious backer means political clout and attention in case there are attempts to compromise it. E.g. Whispers Systems could quickly relocate to Estonia or Germany if US law becomes untenable.

Not so much selfish as realistic: now intelligence agencies like NSA can justify spending much more resources to exploit potential vulnerabilities in Signal, so—with Wikileaks in mind—it practically makes Signal less safe long-term.

Re: EU Commission to staff: Switch to Signal messaging app

#105

Post by rawfan »

tadzik_ wrote: post #49
cpbotha wrote: post #29

Earlier quoted context omitted.

Signal servers only know who talked to whom, but otherwise are physically not able to see even a smattering of the contents of the communication. Correction: The signal servers don't even have that bit of metadata. See [1], they only store the last time that a user connected to the server. [1] https://en.wikipedia.org/wiki/Signal_(software)#Servers

Signal app is also canonically distributed by Google Play/Apple Store, which are US entities under US law. When push comes to shove, an app update may get distributed to select individuals that will happily gather and send all their conversation histories and more. As an EU citizen, I'm half puzzled and half horrified at how happy the EU institutions are to rely on foreign products: especially coming from a country t…

I compiled Signal for iOS and monitored the sent data through a proxy. Both behave identical. There could be a hidden switch in the distributed binaries that triggers other behavior, but I really doubt it. For Android, there are reproducible builds so you can actually check the code is the same. For iOS reproducible builds are harder but should still be possible.

Re: EU Commission to staff: Switch to Signal messaging app

#106

Post by dependenttypes »

lorenzhs wrote: post #76
nottorp wrote: post #59

How is something that's tied to your phone number "secure"? The communications are encrypted, but my identity is public.

Security is not the same thing as anonymity. Maybe Signal's design goals just don't align with your requirements, and that's okay. But that doesn't mean that it can't be the right tool for people with a different set of requirements.

Sim-jacking is a thing that could damage security of future messages in the case of signal.

Re: EU Commission to staff: Switch to Signal messaging app

#107

Post by Tomte »

atticmanatee wrote: post #96
Tomte wrote: post #44

Unfortunately, the IT department of the European Parliament has forbidden Signal Desktop and recommends WhatsApp.

So? Decisions and policies change. Just because someone decided something a few months ago doesn't mean they can't make a new decision now.

Sure they can. And I hope they will.

But I think you confuse the Commission and the Parliament.

The whole point of my comment is that two European bodies that work together closely have diverged in their IT policies.

Re: EU Commission to staff: Switch to Signal messaging app

#108

Post by johannes1234321 »

imtringued wrote: post #85
101404 wrote: post #30

Earlier quoted context omitted.

When the government in Germany does IT projects, they usually burn millions of Euros even for simple projects. And then, years after the planned rollout, the project is still unfinished and no politician wants to touch it anymore. My favorites was the "special email inbox for lawyers". So, I am somewhat hesitant to let the EU develop a chat client.

I always wonder how these projects can be so expensive. Heck, they are so expensive you could just order two companies to deliver a product and pit them against each other so that there is a strong incentive to deliver a working product.

Such projects are expensive since it's not only development but also rollout including training of users.

The development is also more expensive than in other areas since there is need for documentation.

And then there is a flaw in the process: Producing the software has to be done via some bidding process. For writing the requirements documents they already rely on companies, which can add clauses making it hard for competitors, after that the lowest bidder wins. In case there is a competitor and not some big player like T-Systems as the only one the offers typically are "optimistic" meaning that at some point in time the budget will run out and extra budget has to be granted (or the project would fail, which doesn't look good and they'd have to restart the whole process, thus wait another two years) and there a "smart" company can find quite a few extra costs. ("Oh wait, you updated from windows XP to 10, we have to redo a lot and then re-twst and re-certify")

It's a game some companies can play quite well.

That all said: Software is expensive. Gathering requirements is hard. Bureaucracy, which among other things tries to prevent corruption, causes extra work.

Re: EU Commission to staff: Switch to Signal messaging app

#109

Post by mcv »

giancarlostoro wrote: post #99
Arbalest wrote: post #72

That's a tad unfortunate. Signal was just low profile enough that my wife and I could use it in China. This raises the profile of it just a bit higher than I'd like. Further, with the likes of https://news.ycombinator.com/item?id=22202110 having a higher profile makes the organisation more vulnerable to harassment from the government.

My understanding is that US Senators already use it. At least there was a headline on HN ages back. The main issue with apps like Signal in my opinion comes from apps that snoop on your screen. I wouldnt be surprised if there are rogue custom keyboards that do this. I would be more worried if only communist / socialist nations (you all know the ones I am talking about, not sure of a better name so calling them what t…

> "communist / socialist nations (you all know the ones I am talking about, not sure of a better name so calling them what they claim to be)"

"Totalitarian" would be a better word, I think. This isn't specific to economic systems, it's about governments wanting to control the communication of their citizens (or subjects, I guess).

> "If the NSA advises against Signal that might be another concern. It might mean a foreign intelligence has access somehow."

Or it could mean the NSA does not have access. They do have a history of wanting access to encryption systems.

Re: EU Commission to staff: Switch to Signal messaging app

#110

Post by minusf »

mcv wrote: post #39
101404 wrote: post #30

Earlier quoted context omitted.

When the government in Germany does IT projects, they usually burn millions of Euros even for simple projects. And then, years after the planned rollout, the project is still unfinished and no politician wants to touch it anymore. My favorites was the "special email inbox for lawyers". So, I am somewhat hesitant to let the EU develop a chat client.

The Dutch government is also often terrible at managing IT projects. It seems an industry has evolved to game the public procurement rules required by the EU. Those companies just leech money for never-ending IT projects that tend to be over budget, over time, and working poorly.

at least the Dutch sites work. try a post communist country gov site and you'll start appreciating it right away.
Post reply on HN