Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EU Commission to staff: Switch to Signal messaging app

politico.eu

Post reply on HN
Print view View original

161–170 of 289 posts

Re: EU Commission to staff: Switch to Signal messaging app

#161

Post by squiggleblaz »

rawfan wrote: post #105
tadzik_ wrote: post #49

Earlier quoted context omitted.

Signal app is also canonically distributed by Google Play/Apple Store, which are US entities under US law. When push comes to shove, an app update may get distributed to select individuals that will happily gather and send all their conversation histories and more. As an EU citizen, I'm half puzzled and half horrified at how happy the EU institutions are to rely on foreign products: especially coming from a country t…

I compiled Signal for iOS and monitored the sent data through a proxy. Both behave identical. There could be a hidden switch in the distributed binaries that triggers other behavior, but I really doubt it. For Android, there are reproducible builds so you can actually check the code is the same. For iOS reproducible builds are harder but should still be possible.

Can I verify that the build installed on my Android phone[] is identical to the one that I compiled? For instance, if I mount the device in Linux I can only see /mnt/sdcard, not /, so I can't copy the binaries off.

[] i.e. the build installed on my phone, not the build available no Google's server to download.

Re: EU Commission to staff: Switch to Signal messaging app

#162

Post by thu2111 »

pgeorgi wrote: post #74
thu2111 wrote: post #68

Earlier quoted context omitted.

Signal uses Intel SGX to give you some assurances about this, at least for parts of their serving stack. You can run the remote attestation tools and get a report back from Intel that says, in effect, "you connected to a genuine CPU and it's running software with this hash". Then you reproduce the build of the open source code and check the hashes match. I'd be surprised if anyone has ever actually done this. It's a…

> Then you reproduce the build of the open source code and check the hashes match. Assuming that the sgx environment hasn't been tampered with. There have been several flaws in sgx, e.g. https://www.theregister.co.uk/2019/02/12/intel_sgx_hacked/

SGX is patchable via microcode updates (and some parts are software). The remote attestation contains the patchlevel of the system, so, a client can tell if you aren't keeping up to date with security patches.

And so far these are not zero day bugs. The researchers work with Intel to only publish when there are fixes available, usually. It's not much different to any other security system in that sense.

Re: EU Commission to staff: Switch to Signal messaging app

#163

Post by jeltz »

pergadad wrote: post #90
tadzik_ wrote: post #49

Earlier quoted context omitted.

Signal app is also canonically distributed by Google Play/Apple Store, which are US entities under US law. When push comes to shove, an app update may get distributed to select individuals that will happily gather and send all their conversation histories and more. As an EU citizen, I'm half puzzled and half horrified at how happy the EU institutions are to rely on foreign products: especially coming from a country t…

What's the alternative? Private closed-source apps like Threema? This also is not for official communication , it's just for any case where staff would currently use WhatsApp or similar spyware.

Matrix, which is already used by the French government.

Re: EU Commission to staff: Switch to Signal messaging app

#164

Post by basch »

cpach wrote: post #79
pgeorgi wrote: post #77

Earlier quoted context omitted.

Doesn't help figure out if the signal update of the day that comes from the store is any good.

That is true. But given how much interest there is to find vulnerabilities in the Signal app, I would be very surprised if anyone would succeed in putting up a compromised Signal app on the App store and also be able to fly under the radar.

With cooperation, you could literally target just certain devices with the compromised version.

Re: EU Commission to staff: Switch to Signal messaging app

#165

Post by jeltz »

nico_h wrote: post #18
akie wrote: post #7

As an EU citizen I think that's a great decision.

Is there no open source or European alternative? Just keep relying on some Californian dude that insist i give him my and my friends phone numbers? And harass me so i give him more info to “personalize my profile” !?

There is Matrix, which is as far as I know backed by a British company.

Re: EU Commission to staff: Switch to Signal messaging app

#166

Post by squiggleblaz »

thu2111 wrote: post #73
teekert wrote: post #2

But what should I use if I am a politician and fundamentally believe that the government should be able to read my communications?

SMS and phone calls. The infrastructure is all there already. Interestingly, the EU's position on this looks really confused. SMS messages should (in theory) only transit their own local telcos. The USA doesn't get a look-in unless it hacks the telcos themselves. What the EU is doing here is routing all Commission traffic through US based server farms and roots of trust. The phones are controlled from the USA, the co…

> What actual threat are they trying to block here?

A large powerful country ruled by a megalomaniac who has proved he isn't afraid to ruin his country's reputation by abusing his power.

Re: EU Commission to staff: Switch to Signal messaging app

#167

Post by jsjddbbwj »

cannabis_sam wrote: post #151

Because LEOs are oversteping their mark by a billion each and every fucking day, but the populace is too fucking computer illiterate to understand that ”data reading” (the norwegian euphemism for hacking into citizens computers) is extremly damaging to the fundamental concept of democracy. ACAB

You could've put the ACAB at the beginning so we know we shouldn't not mind the things you say.

Re: EU Commission to staff: Switch to Signal messaging app

#168

Post by Forbo »

dependenttypes wrote: post #88
xmdx wrote: post #43

Earlier quoted context omitted.

Why reinvent the wheel? Signal does the job, doesn't store data, not even metadata, and can be used immediately.

> doesn't store data, not even metadata Isn't that just a promise? Also, even then, it is based on your contacts, which are seen by google.

It's a promise that got taken to court and survived. https://signal.org/bigbrother/eastern-virginia-grand-jury/

You can use a different contacts app, you don't have to give all your information to Google. My contacts are managed by a Nextcloud instance.

Re: EU Commission to staff: Switch to Signal messaging app

#169

Post by heymijo »

bambataa wrote: post #144

I once worked in the Commission, briefly. Technical security seemed to be non-existent as far as I could tell (in an admittedly very junior role). Once all of the interns got invited to the U.S. embassy to meet the Ambassador (some guy who literally said he got the job because he was friends with Obama). On the way out the nice embassy staff gave us goodie-bags, complete with handy pen drives... Basically everyone wa…

> some guy who literally said he got the job because he was friends with Obama

There are two kinds of U.S. ambassadors:

1) Career foreign service people

2) Friends of the presidential administration at the time

Examples of the latter aren't hard to find. Off the top of my head I'm familiar with William Timken, a US businessman who was appointed Ambassador to Germany by George W. Bush because he was a huge supporter [0,1]. Colloquially we could say he got the job because "he was a friend of Bush."

I remember being surprised to learn that US Ambassadors were (maybe still are) individually responsible for paying for a good part of their formal duties as Ambassadors(eg throwing parties, travel, etc). So historically, having wealthy people in the role was a requisite. I gleaned this from reading "In the Garden of Beasts" by Erik Larson [2].

The bits I have cobbled together suggest there is an interesting history surrounding the practice of selecting and acting as a US Ambassador.

[0] https://2001-2009.state.gov/outofdate/bios/t/53349.htm

[1] https://www.spiegel.de/international/spiegel/us-german-relat...

[2] https://www.goodreads.com/book/show/9938498-in-the-garden-of...

Re: EU Commission to staff: Switch to Signal messaging app

#170

Post by lxgr »

sschueller wrote: post #65

This is a mistake. They should at least compile their own version and not something that comes from an US based app store under US law. At any point the US can force a change. This is as secure as purchasing a machine from Crypto AG. [1] [1] https://en.wikipedia.org/wiki/Crypto_AG

Signal provides reproducible builds these days: https://signal.org/blog/reproducible-android/

Not sure how feasible this is on iOS (with Bitcode).

Post reply on HN