French ministers to ditch WhatsApp, Signal, Telegram over security fears | Hacker News Reader

French ministers to ditch WhatsApp, Signal, Telegram over security fears

euronews.com

49 pointslayer842 comments

> French prime minister Elisabeth Borne asked that government workers "take all measures" to deploy Olvid by December 8.

> France's junior minister in charge of digital, Jean-Noel Barrot, wrote in a social media post that the messaging app had been used by his team since July 2022.

> "In December, the entire government will use Olvid, the most secure instant messaging service in the world."

Never heard of it before. Has anyone looked into their protocols?

https://olvid.io/assets/documents/2020-12-15_Olvid-specifica...

The client app sources are available under AGPLv3 license:

https://github.com/olvid-io/olvid-android

https://github.com/olvid-io/olvid-ios

Does this mean they are pushing Olvid in general preference over Tchap, their Matrix network? https://joinup.ec.europa.eu/collection/open-source-observato...

While everyone is focused on the technological aspects and how much more secure Olvid can be, let’s point out the obvious fact:

It’s French!

The French government is picking up a French solution built by a French company.

I doubt that the decision was as much technological as it is obviously political.

Unfortunately this is a common pattern in Europe, especially the bigger states like France and Germany.

Unfortunately a country is looking out for their own best interests instead of relying on questionable technology out of their control?

Countries should in-house their critical technology, jobs, and infrastructure true as much as possible. Sure, you can save a few bucks by using that huawei router or Russian developed secure message app. And maybe it’s cheaper to pay people in China to handle all of your advanced fabrication. And foreign investment money seems to flow a lot more freely than domestic. But I think we’ve seen over and over again how countries that control investments and supply chain are more than willing to use their influence as a political lever when it suits them.

There is a slight issue: French officials likely often exchange with their colleagues from other EU countries (or the EU itself in Brussels).

Using what then? will they go back to using pigeons or will President Macron force Olvid upon all European administrations?

We could say that this is another case where the European Union has failed to act united in pursuit of a common goal.

Why would you not use diplomatic cables or encrypted e-mail?

Obviously the latter. EU will mandate installation of this app.

How is Signal a questionable technology? I do understand whatsapp and telegram though.

It's a US based organisation isn't it?

So all the standard US problems (national security letters, etc) would seem to apply.

Signal claims to only have the phone number and, IIRC, last connection time. But being American they seem at least somewhat vulnerable to pressure by the US government.

Hypothesis yet plausible scenario: Signal is actually a NSA/CIA-run honeypot.

As far as I know, nobody knows (for sure) what software runs on the official Signal servers. Only the official client app can be used to communicate with ONLY the Signal server.

US law (as far as I know) forces ALL US-based organizations (including non-profits) to cooperate with any and all government agencies, without being legally allowed to publicly admit or disclose that they're doing so. Thanks to Snowden we know that this has happened A LOT in the past. After Snowden, when exactly did the NSA stop illegally spying on everybody? ... Exactly...

With the above in mind it is possible that all Signal traffic is not actually e2e encrypted and is instead decrypted and re-encrypted at the server.

A less "far fetched" version of the above would be that there are simply known vulnerabilities in the Signal client app (and/or Android and/or iOS and/or other apps) that governments are exploiting to see all decrypted Signal communications.

IMO it would be extremely dumb for an EU country to voluntarily use software made in the US or in any other country if it isn't FULLY open source and FULLY audited (and compiled from source) by the EU country itself.

Just like it is extremely dumb that EU-based companies are PAYING to upload their own trade secrets to their direct competitors in the US through OneDrive.

If you think that the above is far-fetched, read this: https://www.swissinfo.ch/eng/politics/switzerland-closes-inv...

Signal Facing Collapse After CIA Cuts Funding [0]

[0] https://kitklarenberg.substack.com/p/signal-facing-collapse-...

> especially the bigger states like France and Germany

Is the German government pushing to use a German-made messaging app I'm not aware of, or is your comment generic?

Counting zee seconds untì a 0-day brrreaks ziss épe

> Unfortunately this is a common pattern in Europe, especially the bigger states like France and Germany.

Never did the US do that. Ever.

I don’t fully believe this. Over the past few years, we’ve seen politicians in every country using WhatsApp/Signal to conduct their official/corrupt practices without oversight. I cannot imagine they’d abandon those channels for the officially sanctioned one.

And yet many of these same ministers undoubtedly support the EU's recent nth attempts to open encryption backdoors for the most commonly used consumer messaging systems on the continent, arguing that it won't be harmful to security while adding in all the usual "for the children, fighting terrorists" bullshit..

Hypocrisy is never more than a stone's toss away from any government policy.

> With Olvid, all exchanges benefit from the same security as a real discussion behind closed doors.

> The others promised you that. Olvid did it.

Bold claims. Still, don't see the server side source in their public GitHub. Perhaps I'm missing something.

>Is the server code open source?

>The entire client code is open-source. This code, once compiled, makes it possible to produce iOS and Android clients which are able to communicate with our production server (the exact same one used by the client applications downloaded from the App Store or Google Play), and thus enter into contact and chat with all other Olvid users.

>For the moment, however, we have chosen not to publish the source code of the server through which the messages transit.

More here: https://olvid.io/faq/server-and-open-source/#Does%20Olvid%20...?

Would you trust an app that hasn't been updated in 6 months (6/13), period during which iOS17 was released? I do not.

Curious what they dislike about Signal.

Probably the fact that the US Intelligence agencies can't spy on it.

Are you suggesting the French government wants their ministers to be spied upon by the US intelligence services?

the us has enough influence to pressure france into it. why, we’re all friends here! wouldn’t want to “betray” a friend, now would we?

My thoughts exactly, albeit not easily extracted from my comments.

Allegedly the major governments participate in a cooperative spying exchange dubbed Five Eyes. Since it's illegal for Country A to spy on their own citizens, they instead have Country B do it and vice-versa. Then participants exchange info in a quid-pro-quo fashion.

5 eyes - US, UK, Canada, Australia, New Zealand.

France not a member.

All my trust for Signal went out the window with the cryptocurrency updates.

Besides that it is likely heavily targeted by threat actors and no doubt you have people in NSO group focused on just Signal exfiltration.

Having another app will mean additional labor for nation-states and just not relying on off-the-shelf “press button to hack” software.

Quite a few reasons to be concerned. Moxie left Signal and at least one of the new board members has a US government background. The update methods allow issuing a compromised update to targeted users. And while Signal still claims that “in our model, the server knows nothing about users”, for a few years now users’ contacts lists (sweet, sweet metadata nearly as valuable as the messages) have been uploaded to servers, protected only by the notoriously vulnerable Intel SGX technology.

Looks good, but as a personal user, €5 per month to be able to call other users [1] feels quite expensive!

[1] https://olvid.io/pricing/en/

Just use another service where you pay €5 a month by volunteering your private data.

Running servers and writing software is not free.

Some Swiss government agencies did a similar thing going with the Swiss app Threema.

Doesnt France already have a big matrix installation for the government?

Yes they do, it's called Tchap, no idea how well it works https://tchap.beta.gouv.fr/

Edit: reading a bit more about it they will be able to use both Olvid and Tchap, to have a Tchap account you must be a public sector employee so Olvid will be a way to communicate with external contact I guess.

Does anybody know anything about the back story of Olvid?

Someone needs to do a deep dive because it could end up another CIA front like Crypto AG was for decades.

https://www.washingtonpost.com/graphics/2020/world/national-...

Mirror: https://archive.ph/emy0p

What happens when it's not the messaging service that is compromised though? Hmmmh. Can a human be hacked physiologically?

That's called social engineering : https://en.m.wikipedia.org/wiki/Social_engineering_(security...

How are they going to chat with their mistresses?

Political.

Signal is safer than whatever the unproven Olvid is.

This is literally just an ad for Olvid...

Reply on news.ycombinator.com