Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EU Commission to staff: Switch to Signal messaging app

politico.eu

Post reply on HN
Print view View original

191–200 of 289 posts

Re: EU Commission to staff: Switch to Signal messaging app

#191

Post by brazzy »

101404 wrote: post #30
deugtniet wrote: post #16

Earlier quoted context omitted.

France developed their own matrix protocol based network called tchap. Great idea for a nation that wants to stay independent in an increasingly american/chinese tech dependent world.

When the government in Germany does IT projects, they usually burn millions of Euros even for simple projects. And then, years after the planned rollout, the project is still unfinished and no politician wants to touch it anymore. My favorites was the "special email inbox for lawyers". So, I am somewhat hesitant to let the EU develop a chat client.

Do consider that you never read an article "obscure government IT project delivered fully working and only slightly delayed" because that isn't attention-grabbing enough for newspapers to bother with, not because it never happens.

Re: EU Commission to staff: Switch to Signal messaging app

#192

Post by Avamander »

pergadad wrote: post #86
fmajid wrote: post #60

Earlier quoted context omitted.

This is for communications to outsiders, who can't be expected to have an EU-internal app installed on their devices. Signal is reasonably widespread, and probably the best such messaging platform out there, although it has serious issues like the requirement for a phone number.

I've read it requires a phone number so that it does not need to collect or store any (other) data on users.

It also very shadily holds that number hostage, meaning you are forced to wait seven days after uninstalling the app in order to be able to unregister your number from signal. If you don't you'll just not get messages from people on Signal. My opinion of them is quite low thanks to the iMessage-tier bullshit.

Re: EU Commission to staff: Switch to Signal messaging app

#193

Post by Avamander »

icebraining wrote: post #25
nico_h wrote: post #18

Earlier quoted context omitted.

Is there no open source or European alternative? Just keep relying on some Californian dude that insist i give him my and my friends phone numbers? And harass me so i give him more info to “personalize my profile” !?

How does he harass you?!

The phone number deregister flow is such a dark pattern it's incredible. Not something a chat app should ever do to be reputable.

Re: EU Commission to staff: Switch to Signal messaging app

#194

Post by dependenttypes »

Forbo wrote: post #168
dependenttypes wrote: post #88

Earlier quoted context omitted.

> doesn't store data, not even metadata Isn't that just a promise? Also, even then, it is based on your contacts, which are seen by google.

It's a promise that got taken to court and survived. https://signal.org/bigbrother/eastern-virginia-grand-jury/ You can use a different contacts app, you don't have to give all your information to Google. My contacts are managed by a Nextcloud instance.

> You can use a different contacts app, you don't have to give all your information to Google

As far as I know OWS does not mention this anywhere on their site nor on their program -- aren't the issues with usability of other programs and lack of sane defaults (such as with gpg) often given as an argument by signal supporters on why you should prefer it?

That being said, is that even possible? I admit that I am not too familiar with how Android phones work. Signal requires the google play services in order to work, right? Is this not enough for google to see your information?

Re: EU Commission to staff: Switch to Signal messaging app

#195

Post by Avamander »

zrm wrote: post #175
throwawaylolx wrote: post #148

Earlier quoted context omitted.

Not if the staff is lured by all the E2EE promises and all the lock icons to overestimate the security of the app and share more information than they would otherwise.

Not using something that actually improves security because people might think that it actually improves security is a crappy argument. If your phone is insecure for two separate reasons you should fix both of them instead of using each as an excuse not to fix the other.

Yeah, but the fix should be using Matrix, not Signal. IMHO

Re: EU Commission to staff: Switch to Signal messaging app

#196

Post by tialaramex »

dependenttypes wrote: post #106
lorenzhs wrote: post #76

Earlier quoted context omitted.

Security is not the same thing as anonymity. Maybe Signal's design goals just don't align with your requirements, and that's okay. But that doesn't mean that it can't be the right tool for people with a different set of requirements.

Sim-jacking is a thing that could damage security of future messages in the case of signal.

If you are concerned about this you can PIN lock Signal. It will prompt you periodically to confirm you still remember your PIN. When you get a new phone (or somebody tries to SIM-jack you) the new phone needs the PIN which you clearly remember because you kept entering it before.

If you stop answering the PIN confirmations eventually it expires and somebody with that number can sign up (and if they want, set a new PIN).

Regardless of whether you use PIN locks your contacts will be shown that something about the other party in the conversation changed, if they use in-person confirmations of identity they'll be invited to perform that over again.

Re: EU Commission to staff: Switch to Signal messaging app

#197

Post by Avamander »

mcv wrote: post #152
minusf wrote: post #110

Earlier quoted context omitted.

at least the Dutch sites work. try a post communist country gov site and you'll start appreciating it right away.

I don't doubt there are countries that are worse at it, but "the Dutch sites work" is not always true, or sometimes true for questionable definitions of "work". I mean, we've got this nice secure login system for government sites: DigiD, which works fine. So you need that to submit your taxes. A few years ago, it turned out you needed any valid DigiD to submit your taxes, not necessarily your own. There are tons of o…

I wouldn't really call DigiD secure, it doesn't seem to be open-source. Plus, rolling some own protocol/crypto instead of using PKI, that has immense effort behind it to keep secure, is not a good thing.

Estonia has a similar solution, but "Smart-ID" was created after PKI was fully rolled out, it's terrible compared to that. Centralized, unverifiable, stores secrets insecurely, does some cryptographic bullshit. The two solutions somehow seem very related.

Re: EU Commission to staff: Switch to Signal messaging app

#198

Post by throwaway47748 »

blub wrote: post #190
throwaway47748 wrote: post #150

Earlier quoted context omitted.

And I work at a European cybersecurity company and we are routinely tasked to inspect USB drives and devices EU politicians receive at conferences, so I guess we've come full circle. I'm sure the NSA has implants in the EU systems but they're not dumb enough to just hand them out on USB drives that can be traced back to them.

What kind of tools do you use for that? Would they catch BadUSB-like malware?

Lasers, electron microscopes and x-ray scanners used for testing and verification in the semiconductor manufacturing industry plus loads of custom and open source tools.

Re: EU Commission to staff: Switch to Signal messaging app

#199

Post by mcv »

Avamander wrote: post #197
mcv wrote: post #152

Earlier quoted context omitted.

I don't doubt there are countries that are worse at it, but "the Dutch sites work" is not always true, or sometimes true for questionable definitions of "work". I mean, we've got this nice secure login system for government sites: DigiD, which works fine. So you need that to submit your taxes. A few years ago, it turned out you needed any valid DigiD to submit your taxes, not necessarily your own. There are tons of o…

I wouldn't really call DigiD secure, it doesn't seem to be open-source. Plus, rolling some own protocol/crypto instead of using PKI, that has immense effort behind it to keep secure, is not a good thing. Estonia has a similar solution, but "Smart-ID" was created after PKI was fully rolled out, it's terrible compared to that. Centralized, unverifiable, stores secrets insecurely, does some cryptographic bullshit. The t…

Possibly. I'm giving it the benefit of the doubt because I haven't heard of any problems with DigiD itself, but you could certainly question whether that benefit is deserved here.

But my point is that even if DigiD is secure, that's still not going to help you when the tax service uses it incorrectly.

Re: EU Commission to staff: Switch to Signal messaging app

#200

Post by UncleMeat »

dependenttypes wrote: post #187
tialaramex wrote: post #177

Earlier quoted context omitted.

Signal's source code is published so you can go look for yourself. If you believe that despite precautions the source code won't match what actually runs on your phone then realistically you've no real option to use any technological artefact and will be obliged to resort to maybe whispering coded messages to close confidants. As a large technocracy this is not a practical option for the EU. Your phone number is sent…

> so you can go look for yourself I can look it out for myself but there won't be any point as they can simply run different code on their servers. > If you believe that despite precautions the source code won't match what actually runs on your phone On their servers Also what precautions? As far as I know their binaries are not reproducible. > this expires if you stop answering PIN questions correctly After a week i…

> I can look it out for myself but there won't be any point as they can simply run different code on their servers.

OK.

That's true for literally all services. Do you expect to be able to walk into the server rooms and dump the binaries to inspect them?

> Also what precautions? As far as I know their binaries are not reproducible.

The client builds are. Reproducible server builds don't tell you anything about what is running.

Post reply on HN