this post was submitted on 29 Nov 2023
114 points (97.5% liked)

Technology

59427 readers
3070 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago
MODERATORS
L3s@lemmy.world
L3s@fry.gs
L4s@fry.gs
L4s@lemmy.world
enu@lemmy.world
114
The French government doesn't consider WhatsApp, Signal or Telegram secure enough, replaced by Olvid (Google translate link in post text) (www.lepoint.fr)
submitted 11 months ago* (last edited 11 months ago) by Tibert@jlai.lu to c/technology@lemmy.world
36 comments fedilink hide all child comments
 

Another article, much better and presents in more detail that Olvid was audited on an older version and chosen because it was French and they applied for it (French) https://www.numerama.com/tech/1575168-pourquoi-les-ministres-vont-devoir-renoncer-a-whatsapp-signal-et-telegram.html

Google translate link original post : https://www-lepoint-fr.translate.goog/high-tech-internet/les-ministres-francais-invites-a-desinstaller-whatsapp-signal-et-telegram-29-11-2023-2545099_47.php?_x_tr_sl=fr&_x_tr_tl=en&_x_tr_hl=fr&_x_tr_pto=wapp

The translation has some mistakes but good enough to understand the context.

Here is a short summary :

Olvid passed a 35d intrusion test by Anssi (French cybersecurity state organisation) experts or designated experts, with code examination without finding any security breach. Which is not the case of all other 3 messaging apps (either because they didn't do any test, or because they didn't pass).

This makes WhatsApp, signal and telegram unreliable for state security.

And so government members and ministerial offices will have to use Olvid or Tchap (French state in house messaging app).

More detail in the article.

you are viewing a single comment's thread
view the rest of the comments
[โ€“] stimut@aussie.zone 2 points 11 months ago (1 children)

Interesting, thanks for that.

The first link you posted states that the master key is stored. It also states that the information on the page doesn't match the official blog from Signal, but that they've gathered their information from the source code, so I assume it's correct. It does make me wonder why Signal doesn't say that they store the master key though ๐Ÿค”

[โ€“] jet@hackertalks.com 1 points 11 months ago

You don't have to trust blogs, do the experiment yourself, make a new signal account, send a message, set a pin, delete the app, reinstall, recover from pin, and send a message again.. the signing key doesn't change. That is proof the key is in the cloud.

Signal DOES say its in the cloud, but they use the Corporate partial truth..... SVR is for "personal data" ... which the key is. They don't emphasis it, because its such a bad idea, when they implemented this there was a big security online outrage... which seems to have died down.

Signal is a good enough protocol for daily use, but not good enough for nation states, or the truly security conscious. Signal is a step in the path to federated democratic private communication but not the destination.