this post was submitted on 01 Dec 2023
108 points (97.4% liked)

Privacy

80 readers
1 users here now

Icon base by Lorc under CC BY 3.0 with modifications to add a gradient

founded 1 year ago
MODERATORS
 

After the Tchap project based on Matrix, the French Prime Minister asks anyone in the gouvernement to use Olvid, the only app validated by the ANSSI, with metadata encryption and no centralised architecture nor contacts discovery. But only the front-ends are open source, not the back-end.

Source: https://www.politico.eu/article/france-requires-ministers-to-swap-whatsapp-signal-for-french-alternatives/

you are viewing a single comment's thread
view the rest of the comments
[–] joelimgu 28 points 9 months ago (3 children)

I can understand the WhatsApp part, its a closed source app but it makes no sense to ban an open source app bc of security concerns, just order a study of the source code to validate it

[–] plz1 43 points 9 months ago (2 children)

France wants backdoors into these apps, it's not a lack of trust thing.

[–] [email protected] 3 points 9 months ago (1 children)

France wants backdoors into these apps, it’s not a lack of trust thing.

If it's trivial for a host nation to add backdoors to instant messaging services, you'd be agreeing with the government of France and you'd be pressing to migrate your communication out of the hand of third parties.

[–] plz1 1 points 9 months ago (1 children)

I’m not a proponent of any backdoors like this. I use Signal because it puts privacy first.

[–] [email protected] 1 points 9 months ago (1 children)

I’m not a proponent of any backdoors like this.

I'm not sure you got the gist of what I said. The point I made was that if being the host nation of an organization meant that their government can add backdoors at will, using any foreign service would automatically mean you'd be snooped by external actors.

Regardless of where you stand on whether you want to add your own backdoor or not, by your own logic using a foreign service means your services are already compromised.

If that's the case, wouldn't it make sense to simply run your own stuff?

[–] plz1 1 points 9 months ago

I agree. The challenge in running your own stuff is adoption. Having my item chat platform is kind of outlets if no one else is willing to switch to it for me. That’s the same problem I have with Signal when I decided to stop using anything Meta owns.

[–] [email protected] 3 points 9 months ago

Darmanin's dream.

[–] [email protected] 20 points 9 months ago (1 children)

A far better reason not to use WhatsApp is that it is run by Facebook. It was also a primary vector for Pegasus.

[–] [email protected] 1 points 9 months ago (1 children)

A far better reason not to use WhatsApp is that it is run by Facebook. It was also a primary vector for Pegasus.

Aren't you doubling down on the government of France's position?

I mean, the french minister did explicitly stated that "[you] cannot guarantee the security of conversations and information shared via them".

[–] [email protected] 2 points 9 months ago (1 children)

For WhatsApp, sure. For Signal, no.

[–] [email protected] 2 points 9 months ago (1 children)

For Signal, no.

There is an argument to make about using custom versions of Signal that route their traffic through your own infrastructure.

This would count as France running their own service.

Given that Signal relies on centralized servers to route traffic, and if I'm not mistaken they use AWS in US instances, this means that your Signal traffic is being fed straight into the US security services' infrastructure. France might be a staunch ally of the US, but they do go through great lengths to preserve their independence.

[–] [email protected] 1 points 9 months ago

Sure, I'd be the last person to say that Signal is perfect and secure. But it's a damn sight more secure than WhatsApp.

[–] [email protected] 3 points 9 months ago (2 children)

Indeed. However we can think the Olvid company, a private company, was very pushy to promote its product and made people think the other apps are worse. In fact it seems Olvid, compared to Signal, encrypt metadata and does not rely on contacts nor identity server. And because it’s a French app, “sovereignty matters” (even of ministers use Microsoft Office solutions 🤡)

[–] [email protected] 2 points 9 months ago

That shouldn't be a job for the French administration ? How can they give credit to a private company for such sensible informations ?

[–] [email protected] 2 points 9 months ago (2 children)

Western countries got 'lobbying', Eastern countries got 'corruption' amirite? If they really cared, they would've certified Tox, that I2P IM or Simplex...

[–] [email protected] 2 points 9 months ago

If your solution had been chosen, it’s lobbying. If not, call corruption 😂

[–] [email protected] 1 points 9 months ago* (last edited 9 months ago) (1 children)

Western countries got ‘lobbying’

The term "lobbying" doesn't mean corruption. It means basically have meetings with stakeholders to discuss issues regarding policy and agenda.

If you hold a meeting with your local city council asking for a crosswalk, you're engaged in lobbying. If you chat with the local police chief asking for more patrols in some part or another of town, you're engaged in lobbying.

Now, lobbying might set the stage for corruption. If you're talking to your city council about the need for a crosswalk and you show a video of cars speeding by an intersection, that's ok. If instead you tell your city councilman that if he hires your construction company to build that crosswalk then you'll pay him a wad of cash, that's corruption.

Lobbying is not corruption. It's weird how the basis of any democratic system is attacked for being "corruption" to try to justify corruption in corrupt hellholes.

[–] [email protected] 1 points 9 months ago* (last edited 9 months ago) (1 children)

Yeah yeah all is great. But we often hear about 'corporate lobbying' and you've described things mostly carried out by individuals or nonprofits. Now I'm not saying that some corporate entities cannot convince politicians to do anything without bribing them. But the purpose of any private company is creating profits for the shareholders. If they fund a biased research or fabricate evidence to prove their point in talks with governmental bodies that can result in securing more profits, but do not hand money to any politician then is it corruption or lobbying? Or what if they offer their software in exchange for providing backdoors for the government? Or if they engage in price dumping to win a government tender just so that they can overcharge elsewhere?

[–] [email protected] 1 points 9 months ago

But we often hear about ‘corporate lobbying’ and you’ve described things mostly carried out by individuals or nonprofits.

No, I'm describing lobbying. The definition of lobbying doesn't depend on your market capitalization or revenue. A corporation does lobbying, just like unions do and industry representatives and community groups. If you have personal interests and want to raise awareness with stakeholders then you reach out to them.

I mean, Wikipedia's article on lobbying also refers to it as advocacy. From Wikipedia;

In politics, lobbying or advocacy, is the act of lawfully attempting to influence the actions, policies, or decisions of government officials, most often legislators or members of regulatory agencies, but also judges of the judiciary.

"Attempting to influence" is the operative principle.

And so is "lawfully". Which is not the same as the corruption you pinned on "Eastern countries".