cross-posted from : https://lemmy.zip/post/61888435

all 3 comments

sorted by: hot top controversial new old
[–] 7 points 7 months ago (1 child)

Could be because someone in this group is a spy?

  • source
  • hideshow 1 child comment
  • [–] 14 points 7 months ago* (last edited 7 months ago)

    The decision was made according to the report after the Commission became aware of the group's existence last month and deemed the risk of compromise too high. While there is no evidence yet that communication has actually been intercepted, the threat situation has escalated. Just recently, a private phone call between a journalist and an EU official was intercepted and published. Insiders also report sophisticated phishing attempts. These were intended to trick cabinet members into revealing their Signal PIN codes, thus causing them to lose control of their accounts.

    looks like theyre concerned about targeted phishing attacks and organizations being unable to control user accounts from the top down (and thus read their communications) in order to reinstate and do damage control surrounding a negligent user after an attack. ultimately the user is getting tricked into revealing their password, so... human element. perhaps matrix would be best for large organizations like this, for individuals however simplex chat has no identifier tied to the account and in order to compromise a chat theyd need direct access to the computer or the simplex database export afaik, but all programs are vulnerable in that way.

    https://www.heise.de/en/news/Signal-Takes-threat-of-targeted-phishing-attacks-very-seriously-11205329.html

  • source
  • parent
  • [–] 12 points 7 months ago*

    Back to whatsapp it is!/s

  • source
  • 13 comments in c/technology@lemmy.world view that post
    [–] 60 points 7 months ago (1 child)

    Even though I trust Signal and the FBI has raided them multiple times without success. This is still a centralised service that goes through American servers therefore is automatically a threat to sovereignty.

    But again I cannot recommend signal enough they have a brilliant track record. And with good opsec you have little to worry about.

  • source
  • hideshow 1 child comment
  • [–] 23 points 7 months ago (9 children)

    Anyone wana give the tl:dr?

    Why?

  • source
  • hideshow 9 child comments
  • [–] 24 points 7 months ago (7 children)

    The decision was made according to the report after the Commission became aware of the group's existence last month and deemed the risk of compromise too high. While there is no evidence yet that communication has actually been intercepted, the threat situation has escalated.

  • source
  • parent
  • hideshow 7 child comments
  • [–] 21 points 7 months ago (6 children)

    So... Not because "that's a privacy tool, conducting public business there is antidemocratic".

    Instead because, "look at how those Americans use it wrongly, we don't want to be like them."

    . . .

    Huh. I have mixed feelings about this.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 25 points 7 months ago (5 children)

    No not really. More a "its not the right tool for the job" signal is a messenger for private use, EU is working on / has a matrix based messenger that is more suited.

    You still want encryption but also central user management etc. (Which hopefully also includes archiving...).

  • source
  • parent
  • hideshow 5 child comments
  • [–] 7 points 7 months ago (4 children)

    Sounds like a decentralized encrypted messaging platform is needed.

    And when you need the highest trust, you just need to make sure you and the people you are talking to are all on trusted servers.

    so governments would use their own gov.eu server or something, and only communicate sensitive info to others on that network so the info never leaves that server

  • source
  • parent
  • hideshow 4 child comments
  • [–] 4 points 7 months ago (2 children)

    Yes. Something they are working on based on Matrix ;)

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 7 months ago

    Sounds like a decentralized encrypted messaging platform is needed.

    Decentralized probably isn't desirable for this use case; self-hosted is. When designing something for that purpose based on a decentralized protocol like Matrix, it's probably desirable to mandate that the most sensitive conversations take place using a server with decentralization disabled and a client restricted to using only that server.

  • source
  • parent
  • [–] 6 points 7 months ago

    Banning it at-home, is 1 thing, but banning it while abroad & in hostile-regimes, would be idiocy: at the home-end, record the whole interaction, & make that part of official-record.

    But make it impossible for the hostile-regime to get anything from either the in-their-country device, or the encrypted stream which they can't crack.


    the fact that corruption wants nonaccountability is 1 valid concern.

    but the fact that hostile-regimes exist, & we're in economic-meshing with them, means that we need to be able to have officials in those countries.

    Which makes the requirement for communications which the hostile-regime can't crack real.

    Oversimplificaiton is incompetent "management".

    Don't solve the wrong problem, & pretend that you aren't responsible for the authority you mis-wielded.

    That they were having a non-accountable-within-the-EU group on Signal, that IS AN ACTUAL PROBLEM, but there are use-cases for Signal to be needed, if done properly.

    _ /\ _

  • source
  • 3 comments in c/privacy@programming.dev view that post
    [–] 7 points 7 months ago (1 child)

    *for internal communication

    The EU Commission is cracking down harder on digital espionage. It has instructed its highest-ranking officials to immediately dissolve a central Signal group for internal communication. According to Politico, department heads and their deputies are primarily affected by this measure. The order stems from fears that the chat group may have become the target of targeted cyberattacks.

    I assume it is to prevent this mess

    https://en.wikipedia.org/wiki/United_States_government_group_chat_leaks

  • source
  • hideshow 1 child comment
  • [–] 4 points 7 months ago

    The article did reference the Signal chat leak. It's also worth noting that Signal is secure, its just also available to the public and not designed for officials only. Cryptography is useless if the device itself is compromised or if someone is added to a chat. I assume they're making people use an internal system that only officials have accounts on. That way you can accidentally add a journalist or impersonator to the chat.

    While Signal is still considered one of the most secure options, security ends when the end device itself is compromised. If an attacker gains control of the smartphone, even the best end-to-end encryption is of little use: chats and images can then be read directly on the device. However, Herpig emphasizes that there are currently few better alternatives to encrypted messengers like Signal or Threema.

  • source
  • parent
  • [–] 3 points 7 months ago

    Group chats are the problem, not Signal itself.

  • source