Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BundesMessenger, a secure messenger for Germany’s public administration

element.io

Post reply on HN
Print view View original

91–100 of 278 posts

Re: BundesMessenger, a secure messenger for Germany’s public administration

#91

Post by Arathorn »

martinralbrecht wrote: post #29
Arathorn wrote: post #23

Earlier quoted context omitted.

Gematik co-funded the most recent Matrix audit of vodozemac[1], and is poised to fund 3 more (of matrix-rust-sdk-crypto, matrix-rust-sdk and the whole stack end-to-end) to ensure the E2EE is where it needs to be. So I'd say that the German government definitely cares about E2EE for its civil servants, and we're very grateful for them funding security research. Meanwhile, BWI is helping fund the work needed to address…

Cool, thanks! That's interesting to know. Do you know how they deal with FOI and auditable communications in this case? PS: I talked about the seemingly unexploitable IND-CCA vulnerability because it means Matrix can't give you some security guarantees : It should be fine - we don't have an exploit, only a vulnerability - but it is not clear how to reason to arrive at "there cannot be an exploit". If you care about s…

Good question about FOI and audit; unsure for their deployment. In general we use audit bots when needed (which are visible in the member list), and even in a client-controlled-membership world, they would complain bitterly if they saw traffic which they didn’t have the keys for.

Fair enough on IND-CCA; as you know, we are fixing it anyway.

Re: BundesMessenger, a secure messenger for Germany’s public administration

#93

Post by Arathorn »

Sporktacular wrote: post #48

These guys keep pushing the idea that if it's not federated, it's closed and proprietary. In at least the cases of Signal and Threema that's just not true.

Signal and Threema are proprietary, in that the protocol they speak is vendor-specific and not openly standardised. You are literally locked to that system, and neither of them allow 3rd party clients to connect.

Moreover, Threema's server is closed-source and so completely proprietary - and you could argue that Signal's server is often closed-source too, given years occasionally go by without public code releases.

This is the rationale.

Re: BundesMessenger, a secure messenger for Germany’s public administration

#94

Post by Hamuko »

galaxyLogic wrote: post #92

This is great "Matrix is the equivalent to SMTP". Goodbye Microsoft or Slack -specific chat services. Welcome them to compete with their Matrix client-apps. And hey, we're in the Matrix finally.

Now I'm just waiting for the Matrix app that I don't hate.

And for that matter, the SMTP app that I don't hate.

Re: BundesMessenger, a secure messenger for Germany’s public administration

#95

Post by jszymborski »

k__ wrote: post #90
jszymborski wrote: post #82

Earlier quoted context omitted.

It certainly hasn't been w/o growing pains or detractors. I still occasionally get rooms or spaces borked, and that frequency increases if E2EE is enabled. The current server implementation is not svelte in the least, but that's a problem that's being solved with new server implementations that are already 90% of the way there (look-up Dendrite and Conduit if you haven't heard of them).

getting borked?

The most recent instance I experienced was the GrapheneOS rooms which suddenly just stopped working.

https://grapheneos.social/@GrapheneOS/109510405342409074

Re: BundesMessenger, a secure messenger for Germany’s public administration

#96

Post by kioleanu »

victor106 wrote: post #44
kioleanu wrote: post #20

Earlier quoted context omitted.

It hasn’t but it’s on the right track. I am working as a developer in one of the federal agencies and have direct contact with the efforts. It helps a lot that public agencies can now offer a so called IT Zulage of a few hundred euros to 1000 per months that brings salaries on par with the private sector. In my team, this worked wonders and we managed to get some really good people. On the other hand, the task is eno…

why can't you hire consultants to do take on some of the work?

We do, we have 2-4 people freelancing any given year

Re: BundesMessenger, a secure messenger for Germany’s public administration

#97

Post by [deleted] »

strbean wrote: post #79
catiopatio wrote: post #70

Earlier quoted context omitted.

It doesn’t take a religious nut or a conspiracy theorist to see the catastrophically enormous downsides of universally mandated, centrally managed, and cryptographically-backed state identification cards, complete with RFID. Imagine, for example, that upon declaring a protest unlawful, the police could simply scan all the RFID-enabled ID cards in the area and issue everyone a court summons. Not carrying an ID card? N…

There is quite a lot of slipper slope going on here. > centrally managed, and cryptographically-backed state identification cards, complete with RFID. Does not necessitate: > universally mandated > No access to anything > felony to do so intentionally > Your 2FA and disk encryption is mandatorily tied to your ID card All the latter things are awful, but we can have the first thing without any of the latter things.

[deleted]

Re: BundesMessenger, a secure messenger for Germany’s public administration

#98

Post by shortstuffsushi »

jszymborski wrote: post #78
catiopatio wrote: post #70

Earlier quoted context omitted.

It doesn’t take a religious nut or a conspiracy theorist to see the catastrophically enormous downsides of universally mandated, centrally managed, and cryptographically-backed state identification cards, complete with RFID. Imagine, for example, that upon declaring a protest unlawful, the police could simply scan all the RFID-enabled ID cards in the area and issue everyone a court summons. Not carrying an ID card? N…

See, I totally agree that you shouldn't require identification for most services. But, for things like banking, car registration, etc... we require strong ID'ing, and it behooves society to make it secure. I still think municipalities should own their own data rather than have it stored at a central federal level, but we need municipalities to rely on something better than a serially-issued social insurance/security…

Worth calling out imo, in our current world you have recourse and an ability to "recover" from identity theft (to some extent). If the government controls your identity and revokes some piece, what can you do?

Re: BundesMessenger, a secure messenger for Germany’s public administration

#99

Post by kioleanu »

xcambar wrote: post #39
codethief wrote: post #37

Earlier quoted context omitted.

> we were discussing last week that if we had double the man power Are you looking for more people?

This. Please point us to where things happen. Also, how fluent in German must one be?

Yes, see interamt.de for open positions. You have to be fluent, I’m afraid, everything is done in German and you need to understand what’s needed and relay your own thoughts properly. There are many specific terms and processes and abbreviations

Re: BundesMessenger, a secure messenger for Germany’s public administration

#100

Post by Pr0ject217 »

"Real time collaboration systems such as Microsoft Teams, Slack, Mattermost, Wire, Threema, WhatsApp and Signal are currently all closed proprietary systems - meaning they are walled gardens whereby all parties have to use the same vendor."

Signal is in this list. Isn't this false? The server and clients are here: https://github.com/signalapp

Post reply on HN