9 ms·
India reportedly wants to build its own WhatsApp for government communications
- ailideex 7y agoHopefully they rather use something like http://matrix.org http://matrix.org
- Perceptes 7y agoAgreed. The French government did exactly this!
- DocTomoe 7y ago... and it failed almost instantly. https://techcrunch.com/2019/04/19/security-flaw-in-french-government-messaging-app-exposed-confidential-conversations/ https://techcrunch.com/2019/04/19/security-flaw-in-french-go...
- devoply 7y agoDoes not look like it. Looks like they found a flaw and fixed it. And this sort of thing, using open source project and building custom projects for private communication between private entities makes perfect sense. Anyone would be a fool to use Whatsapp for any conversations you don't want private companies and Western governments to have access to.
- xtreak29 7y agoThis was an issue with Python's email parser. Relevant issue : https://bugs.python.org/issue34155 https://bugs.python.org/issue34155
- vqdwj 7y agoIf WhatsApp had a similar issue because of some 3rd party software they rely on I'm sure nobody would give them a free pass.
- addicted 7y agoWhatsApp probably has bugs like these discovered on a monthly basis, that we never even hear about. The only time we hear about bugs with non OS software is when there is a masssive breach, FB initially reveals it only affects a small number of people, a few weeks later quietly revised that to a few 10s of million, and then a couple of months later buried somewhere that it was actually hundreds of millions of users affected.
- FAKEDETECTOR 7y agoIt seems like you want to suggest that Matrix is not secure - as others pointed out already the bug that was reported about has nothing to do with matrix and was fixed quickly. Also you do not seem to understand that bugs and resulting security problems are something that happen every day - and get fixed quickly, usually, after discovery. This is what they mean when domain experts say things like "security is a process". Also here we see a perfect example of why you want to use open source software for all governmental software: after a bug was found your admins can see the code changes and understand, if the bug still exists or not. Even more, only with open source software your admins and developers can read the code and search for bugs, too! This is what makes open source software a very good idea! You are welcome to the world of free and open software, and after some reading about the basic principles I am sure you will understand why open source software is used by so many companies and organizations around the world. BTW re the website you pointed to: I see a very annoying, totally absurd cookie dialog that makes me click at least five times and still does not give me a choice to not accept cookies at all. Please do not link to that website until they wake up and stop insulting visitors with this UI nightmare and learned that nobody needs to set cookies to publish content. Also this is not a website a pro developer would ever read or point to - always prefer to point to the primary source of information.
- DocTomoe 7y agoThe goal was to provide a secure whatsapp alternative for he French administration. They failed the "secure" part - nothing else matters, and that does not mean that rolling your own should be discouraged - it means that these things are hard, and chances are your pet project will be less secure than established systems. > Please do not link to that website until they wake up and stop insulting visitors with this UI nightmare Had I known that this happend for your UA, I would not have - worked like a charm on my side. Thank the French for that, who are the main reason behind the EU legislation about Cookies. > Also this is not a website a pro developer would ever read or point to Gatekeeping, are we? "Pro developers" don't waste time searching for some obscure original source for a meaningless online discussion - they pick the first result of their favorite search engine.
- 7y ago
- edhelas 7y agoOr maybe something like… the existing IETF standard for IM: XMPP. With plenty of implementations, support across the globe, servers that can scale up to millions of sessions.
- metildaa 7y agoConversations is the only decent XMPP client, and server XEP support is a mess. Its unusable for normal people if you want to use any kind of advanced features.
- Nux 7y agoI concur, tried to adopt it at dayjob when HipChat closed, but it was impossible. Conversations IM client is alright, but we couldn't find a client for IOS that just worked. It's mission impossible. I hope they go for Matrix, like France did, but I get a feeling they'll be hit hard by NIH.
- upofadown 7y agoYeah, iOS XMPP client support does seem to be the issue. Riot gets cross platform support from electron. Perhaps the world needs an electron based XMPP client... One relatively low effort path for a government might be to simply adopt something like Chatsecure and fix it.
- pgeorgi 7y agoI found Monal (monal.im) to be a better maintained iOS client than Chatsecure, very responsive developer, too.
- jcbrand 7y agoIt would be perfectly fine for the Indian gov to fork Conversations and deploy their own XMPP servers, thereby not having to worry about sever XEP support.
- baroffoos 7y ago
- logo2k 7y agoAre there any other suggestions?
- ComodoHacker 7y agoHey, but where all the budget will go then?
- thewhitetulip 7y agoIf past is any indication, either of the Ambanis or Adani will get contract. But it's a good idea nonetheless. A lot of confidential data is sent over WhatsApp. Imagine the data that PM/FM has!
- divs1210 7y agohost your own mattermost instance
- the_common_man 7y agoThe free edition has no basic access control.
- sailfast 7y agoTo clarify - you mean that if you have access to the database then you can see all messages?
- the_common_man 7y agoAnyone can archive any channel in the free instance. It is meant to be used by a trusted team apparently
- netsharc 7y agoIf this is their track record, it'd be like using public Twitter posts for government comms: https://gizmodo.com/simple-hack-turns-indias-massive-biometric-database-int-1828972521 https://gizmodo.com/simple-hack-turns-indias-massive-biometr...
- vmurthy 7y agoAn interesting aside: In 1998, India tested its nuclear weapons (Pokhran-II [1]). Almost immediately, US imposed sanctions. One of the terms of the sanction? "Bar the export of certain defense and technology material" [2]. I can't find a source but I do remember that IE used to ship with reduced encryption. Perhaps we have learnt some lessons since then :-) [1]https://en.wikipedia.org/wiki/Pokhran-II https://en.wikipedia.org/wiki/Pokhran-II [2]http://edition.cnn.com/WORLD/asiapcf/9805/13/india.us/ http://edition.cnn.com/WORLD/asiapcf/9805/13/india.us/
- lgeorget 7y agoIndeed, encryption algorithms and implementation are subject to restrictions on export similar to munitions. It used to be very strict https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...
- dpacmittal 7y agoThere's an interesting story about PGP author circumventing that law by publishing his code in a book.
- pvg 7y agoWhat's the relationship between these two things? The export controls were broad, in place before 1998 and not specific to India.
- kyshoc 7y agoThis is why my hair stands up every time we have the "backdoored encryption" discussion -- we had, and probably still have, people in positions of power that think of encryption as something that should be regulated on the order that guided missiles are.
- vmurthy 7y agoAs a technologist, I agree with your view. But in cases like sanctions, I think the "Let me show who has the power" mentality takes over. So, a country (say USA) can pressure its companies (like Microsoft in 1998) to stop providing some features/services/products to have some leverage over the sanctioned country. The unfortunate pattern in history has been that politics wins over rationality.
- fouc 7y agoWhat are the chances they're going to use Java instead of Erlang?
- faceplanted 7y agoAre Erlang engineers hard to find in India? They have a small but solid base in the UK, but the UK also hosts a few tech companies and I think a couple of the inventors and major contributors to the language, so it might just be an outlier.
- arvinsim 7y agoFrom what I remember, Java engineers were everywhere in India.
- rusticpenn 7y agoLet people know that erlang has demand, you will find a lot of Indian erlang engineers.
- arvinsim 7y agoAre these Erlang engineers diving into Elixir?
- macspoofing 7y agoDoes it matter? Routing text is a solved problem and not particularly hard at any scale. The interesting parts for any potential implementation only pertain to things like workflow, integrations to existing applications and services and regulatory requirements (export, backup etc) - from that end, Erlang is not a great option.
- visarga 7y agoIt's not just text, but images, audio and live video. Tons of images are being uploaded everyday to WhatsApp.
- MarkMc 7y agoI think Telegram is open source, so they could just fork it
- rvense 7y agoThe server part isn't. There are several alternatives where both sides are, though.
- giancarlostoro 7y agoThey are better off forking Wire which I think isnt perfect either but seems to be properly open sourced frontend and backend.
- chewz 7y agoWhat do they have to hide? Internal communication is usually great source for historians and posterity. Not to mention parliamentary investigative bodies.
- helloindia 7y ago"The rationale behind the move is to cut reliance on foreign entities, the report said, a concern that has somehow manifested amid U.S.’s ongoing tussle with Huawei and China."
- addicted 7y agoThese are the kinds of damage that the US is facing that has gonna have severe adverse effects, that will not show up before the next elections, so the current US administration doesn’t care. Other stuff would be that it’s likely that US companies will not even be considered in the future by governments and companies for products, where in the past, the likes of an IBM or Oracle would be the front runner.
- chewz 7y agoYeh, I understand. My comment was half tongue-in-check and half a pity that future historians won't have a look into internal communications of this sort.
- vinay_ys 7y ago> What do they have to hide? This is the kind of dangerous statement that has done more damage to privacy and security conversation than anything else. Please stop.
- chewz 7y ago> Please stop. Stop expecting transparent and accountable politics? Yeh, sure. It's India.
- whoisninja 7y agoit will be hacked in a day
- samsungha 7y agoAwesome!
- anon121212 7y agoBet you TCS or most likely Infosys will be the implementation partner. Tax money goes in. Crap comes out. As usual. Public will sing praises.
- th3iedkid 7y agoNot that I like TCS or Infosys, but why does everyone appear to hate them so much? If most organisations appear to go with them, is it because they lack market options at what they offer? On the other hand ,Wouldn’t some other govt sub-org like CDAC etc might get to build this via NIC or whomsoever supervises this?
- anon121212 7y agoIn one word, cost! But you get what you pay for and it shows in the quality of the work. The engineers are just fresh out of college and are given titles like junior dev or senior dev rather quickly to retain them. This combined with fake resumes compound the problem where a solution to any problem is simply reboot the computer. CDAC/NIC are even worse -- just go see the state of some state-run sites, they've got people that are stuck in the past, can't be fired and won't change things because hey, why change things when you will get paid nonetheless!
- geodel 7y agoI have read somewhere that this software will work in perfect harmony with Aakash tablet: another state of the art government project. Our beloved PM sending messages via 'Raamdoot' messenger on Aakash tablet will set the tone for entire bureaucracy.
- ThinkBeat 7y agoThis is good. Hopefully it inspired a bit of innovation. China has learned a lot from not adopting all the US products and implementing their own product and in some ways we see things they did, that our products had not done yet. The monoculture that the digital hegemony of a few multi national corporations creating the only viable solutions is not healthy. Making something like a government chat system, might be the seed for creating a public system.
- Bhilai 7y agoIts scary how prevalent Whats App is in India. A lot of official communication happens over WhatsApp. So it makes sense to move sensitive communication over something homegrown and outside jurisdiction of foreign government. But Indian government does not have a very good track record in terms of cyber security so an actual secure implementation seems pretty far off.
- deleted 7y ago[deleted]
- srameshc 7y agoOMG your username :) I love that place. It is absolutely scary when government officials in India ask you for your sensitive information to be sent through WhatsApp and when you can't suggest them an alternative way or say them no.
- deleted 7y ago[deleted]
- vinay_ys 7y agoI hope they commission a project to build this completely indigenously to be built from scratch and set the scale requirements high enough to scale to 100million+ people in a single private organization along with stringent sufficiently future proof security requirements. India has a very large base of software engineers, security researchers and local cloud builders that would love to contribute to such a project.
- germanlee 7y agoWhy don't they just support the growth of their own homegrown "WhatsApp"? With government support and financial support, india could easily have an indian "whatsapp". WhatsApp isn't technological sophisticated. It's simply a large network. With government/business "tweaking", india could help their own "whatsapp" company take over much of that market from facebook. Why hand the entire indian market over to facebook and zuckerburg? There is no reason why large and significant markets shouldn't be dominated by local businesses. Not to say whatsapp should be banned from india, but it's only the incompetence of government/business that cedes their market to foreign companies. This also applies to the EU. It's insane to me that the EU doesn't have their own google, facebook, etc.
- rstuart4133 7y agoThere are suggestions of starting with lots of other non-open source platforms here, but no mention of Signal. That's downright odd. WhatsApp is a fork of Signal. Why on earth wouldn't you just use Signal as your base? After all Signal open sources everything. That aside, it's a bit of a mystery why anyone would choose a proprietary app whose owner could be in cahoots with anybody and you would never know over an open source app, given the entire point of the exercise to ensure your communications private. Facebook is even talking about monetising WhatsApp chats, and governments are talking about forcing Facebook to store the chats so they can be retrieved with a suitable warrant. Yet people still choose use these apps for private communications. Such is the power of the marketing dollar, I guess.
- raylangivens 7y agoThe Indian Government is extremely inept at assessing at technological needs. Aadhar is a good example of what came out of the Indian Government (technically Nilekani & Co.). The pathetic Indian Government websites would show you what they are capable of when designing a product that is supposed to work for Millions/Billions of people. They are just going to line up TCS or Wipro's pockets because that's the cheapest and also the crappiest.