21–30 of 278 posts
So people who need to chat with German govt entities have to do what now?
Since Matrix (and thus BundesMessenger?) currently doesn't provide standard security guarantees for its end-to-end encryption (the mitigation to the "Simple confidentiality break" from https://nebuchadnezzar-megolm.github.io/ is still in the design phase; same for the IND-CCA break, but that doesn't seem exploitable in practice) I wonder how much the German government cares about E2EE for its civil servants? The blog…
Meanwhile, BWI is helping fund the work needed to address clientside controlled room membership (https://github.com/matrix-org/matrix-spec-proposals/pull/391...) as highlighted in your paper, as well as TOFU... and they're also funding work to provide MLS as an option for E2EE in Matrix too[2].
Unsure why you're talking about the unexploitable IND-CCA break :)
[1] https://matrix.org/blog/2022/05/16/independent-public-audit-...
[2] https://www.golem.de/news/bwmessenger-vom-messenger-der-bund...
So people who need to chat with German govt entities have to do what now?
As mentioned in the article, the German health services already adopted Matrix for their "TI-Messenger", which is supposed to make secure communication between health care professionals easier. Or, well, possible at all. Right now this is a morass of "don't mention anything private" emails, letters and faxes. I'm surprised that ticker tape isn't involved somehow. But don't worry, if German health services doing somet…
And we still have to walk to the doctor's office to get that prescription for the same Asthma medicine you always get every three months. Instead of just getting it electronically to the nearest pharmacy. Now we have to queue up in the doctor's office with sick people, wait for them to print and sign a red piece of paper and then walk to the pharmacy. Maybe this changes too in the future?
As mentioned in the article, the German health services already adopted Matrix for their "TI-Messenger", which is supposed to make secure communication between health care professionals easier. Or, well, possible at all. Right now this is a morass of "don't mention anything private" emails, letters and faxes. I'm surprised that ticker tape isn't involved somehow. But don't worry, if German health services doing somet…
And we still have to walk to the doctor's office to get that prescription for the same Asthma medicine you always get every three months. Instead of just getting it electronically to the nearest pharmacy. Now we have to queue up in the doctor's office with sick people, wait for them to print and sign a red piece of paper and then walk to the pharmacy. Maybe this changes too in the future?
Currently was supposed to be in a pilot phase in two regions, but both of them cancelled it due to privacy concerns: https://www1.wdr.de/nachrichten/erezept-kelber-medizin-westf...
As mentioned in the article, the German health services already adopted Matrix for their "TI-Messenger", which is supposed to make secure communication between health care professionals easier. Or, well, possible at all. Right now this is a morass of "don't mention anything private" emails, letters and faxes. I'm surprised that ticker tape isn't involved somehow. But don't worry, if German health services doing somet…
I wonder how kosher it was.
One of the bright lights on horizon is that the Bundeswehr opted for a open-source, federated, multi-platform and secure messaging framework. Instead of some proprietary, closed-source piece of crap from a Big-IT vendor which make same depending in a negative way.
Since Matrix (and thus BundesMessenger?) currently doesn't provide standard security guarantees for its end-to-end encryption (the mitigation to the "Simple confidentiality break" from https://nebuchadnezzar-megolm.github.io/ is still in the design phase; same for the IND-CCA break, but that doesn't seem exploitable in practice) I wonder how much the German government cares about E2EE for its civil servants? The blog…
Gematik co-funded the most recent Matrix audit of vodozemac[1], and is poised to fund 3 more (of matrix-rust-sdk-crypto, matrix-rust-sdk and the whole stack end-to-end) to ensure the E2EE is where it needs to be. So I'd say that the German government definitely cares about E2EE for its civil servants, and we're very grateful for them funding security research. Meanwhile, BWI is helping fund the work needed to address…
PS: I talked about the seemingly unexploitable IND-CCA vulnerability because it means Matrix can't give you some security guarantees: It should be fine - we don't have an exploit, only a vulnerability - but it is not clear how to reason to arrive at "there cannot be an exploit". If you care about security guarantees, you care about it.
Earlier quoted context omitted.
And we still have to walk to the doctor's office to get that prescription for the same Asthma medicine you always get every three months. Instead of just getting it electronically to the nearest pharmacy. Now we have to queue up in the doctor's office with sick people, wait for them to print and sign a red piece of paper and then walk to the pharmacy. Maybe this changes too in the future?
You can’t call in advance and pick up the receipt an hour later?