Live data from Hacker News

Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

matrix.org

11–20 of 204 posts

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#11

Earlier quoted context omitted.

What do you mean ?

If progressively more governmental communications are made through encrypted means, we cannot access them as citizens.

Yeah, end-to-end encryption is strange here. Aren't there laws in France to ensure retention of government employee communications?

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#12
post #5

Does this make freedom of information requests less useful to the public?

No. The information being securely stored does not mean users wouldn't have to turn over the information. However usually FoI doesn't usually apply to instant messaging anyway, I think.

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#14
well, this is what scares me. because, the conversation may be encrypted (protocol, packets), but still messages can be accessible by the powers that be through variety of means.

especially considering they "forked" it, who knows what they will do with it (log keystrokes, take screenshots, in the disguise of diagnostic reasons?).

anytime you are reading a message from your app, or sending a message, the app have all the powers to capture the data in its raw form before transmission, encrypt it with some key that only they have control of, etc. so unless the gov't releases their source code to be truly open (which even then i don't see how you will ever know), you won't get the transparency you need.

encryption is such a buzzword, people think anything encrypted means you are fully secure. this is simply false.

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#15

Earlier quoted context omitted.

What do you mean ?

If progressively more governmental communications are made through encrypted means, we cannot access them as citizens.

Thanks, I understand but those communications are not supposed to be accessible. This tool will be used by top level gouvernement employees.

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#16

Do the French make their own hardware? An encryption app is useless if you don't 100% trust the hardware. Tainted hardware could figure out, log and send your keystrokes from screen taps/swipes all from silicon.

You're totally right. But it's a step forward anyway. Perhaps that hardware will come after.

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#17

well, this is what scares me. because, the conversation may be encrypted (protocol, packets), but still messages can be accessible by the powers that be through variety of means. especially considering they "forked" it, who knows what they will do with it (log keystrokes, take screenshots, in the disguise of diagnostic reasons?). anytime you are reading a message from your app, or sending a message, the app have all…

When an encrypted conversation is setup properly with Matrix.org you get a notification every time a new device appears in the chatroom and you have to manually whitelist it. Even if you already whitelisted one of the devices for a known user. Furthermore you can host the server yourself on an HTTPS server.

It's way more secure than Facebook messenger or SMS.

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#18

Earlier quoted context omitted.

If progressively more governmental communications are made through encrypted means, we cannot access them as citizens.

Yeah, end-to-end encryption is strange here. Aren't there laws in France to ensure retention of government employee communications?

The open-source Matrix.org server Synapse has everything in plaintext on the server.

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#19

Earlier quoted context omitted.

What do you mean ?

If progressively more governmental communications are made through encrypted means, we cannot access them as citizens.

If they're subject to records retention requirements, they should be retained anyway; and if they're not, they're in the same category as things like phone calls which are currently ephemeral.

(Note that in first world countries phone calls will be digital everywhere except maybe the last mile, and GSM and upwards are digital to the handset)

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#20

Do the French make their own hardware? An encryption app is useless if you don't 100% trust the hardware. Tainted hardware could figure out, log and send your keystrokes from screen taps/swipes all from silicon.

TThis is a rather extreme threat model given how expensive it is to carry out and very obvious once discovered.

But France does have some domestic defence capability here - Thales make hardware security modules and similar products, and STMicroelectronics has chip design expertise while being partly state-owned.

Post reply on HN