5 ms·

>Some of the mobile applications that have been blocked include Crypviser, Enigma, Safeswiss, Wickrme, Mediafire, Briar, BChat, Nandbox, Conion, IMO, Element, S

>Some of the mobile applications that have been blocked include Crypviser, Enigma, Safeswiss, Wickrme, Mediafire, Briar, BChat, Nandbox, Conion, IMO, Element, Second line, Zangi, Threema, and others. > While investigating one of these channels, it was discovered that the app did not have a representative in India, making it challenging to monitor activities on the platform. This is basically an indirect validation that most non listed messaging apps supposedly offering e2e encryption such as Whatsapp or Signal have backdoors with access from any government asking for access.

deleted 4y ago
[deleted]
masklinn 4y ago
Is it? Or is it that they’re starting from clients with low usage rates & little to no backing, which would be easier to attack? And / or they’re going at it network bu network?
jraph 4y ago
> This is basically an indirect validation that most non listed messaging apps supposedly offering e2e encryption such as Whatsapp or Signal have backdoors with access from any government asking for access. Not really. At least, I'm not convinced. Signal for instance does not have public channels like Matrix has, maybe that's the big difference. Signal's code can also be audited if in doubt (well, actually, Signal could always provide altered binaries on the App Store and Google Play Store, you'd have to build it yourself to be sure - though they do have reproducible builds for Android [1]). [1] https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/
- prmoustache 4y ago
  How many people are: - auditing signal source code - recompiling the signal client to make sure they haven't tampered binaries. I remember a blog post from signal showing how to build a compilation environment to validate the source but it was itself relying on docker images that you should first rebuild yourself to make sure the compiler and any other dependencies are the same as the upstream ones.
  - jraph 4y ago
    Sure. That's why I wrote "if in doubt". There was this statement that what's happening more or less proves that Signal & co has backdoors. That's a guess but the good thing is that we can check. It takes one person to do it. Not everybody has to do it. If I remember correctly, binaries sent to the Play Store are signed by the developer so Google can't really temper with the binary themselves, or they would need to modify Android so it ignores the problem. But at this point, this means Android itself is backdoored. (Which I don't exclude, btw - we need to trust a whole host of binaries for the phone drivers, and the hardware itself. At this point the issue is deeper than just signal though)
    - detuur 4y ago
      Also, if that were true, there wouldn't be a reason to ban Element or these other apps in the first place. Reproducible builds, combined with Android's developer-signed binaries, means that you don't _need_ to be super-vigilant to detect backdoors. You can investigate binaries after the fact (especially since virtually every version of popular apps is archived on third-party apk sites), and see that the signed build is not reproducible and at that point you can very easily dig into the binary to see which changes were made.
    - JeremyNT 4y ago
      I believe Google now can do the app signing. They seem to encourage developers to upload keys [0]. The stated reason is to generate dynamic packages based on device details. I don't remember the details but I believe it is their intention to eventually remove the ability for developers to sign their own packages. [0] https://developer.android.com/guide/app-bundle/faq https://developer.android.com/guide/app-bundle/faq
- NayamAmarshe 4y ago
  Nobody can verify backend code though, that's always an issue.
  - jraph 4y ago
    Signal is e2ee. The point of e2ee is that you can not trust the backend code (except for clear data it actually manipulates - which is still an issue indeed - Message contents are encrypted though) This is the case for any e2ee solutions. For instance my company develops CryptPad [1], which is a full open source office suite with e2ee. The server admins can't access your content and you don't need to trust the backend, which just passes messages and store encrypted messages. This is the whole point. e2ee has drawbacks: it's very difficult, if not impossible, to provide indexed search for encrypted content on the server, the client needs to do it which might be impractical. [1] https://cryptpad.org/ https://cryptpad.org/
    - dadoomer 4y ago
      I really like cryptpad. Thank you for developing it. I have used it a few times in a professional setting even when there is no need for end-to-end encryption, and it is a good experience so far. I encourage others to try it .
    - NayamAmarshe 4y ago
      > Signal is e2ee. That still does not change anything though. The backend is unverifiable, that's a fact. Why talk about E2EE, I wasn't really talking about that. Signal for a whole year was running a different server code and nobody even could tell that they added some cryptocoin stuff. On top of that, metadata, server connection and anything other than the message content is all at the mercy of the server owner.
      - bentley 4y ago
        > On top of that, metadata, server connection and anything other than the message content is all at the mercy of the server owner. Except to the extent that the client is explicitly designed to minimize what metadata is exposed to the server.
- 2Gkashmiri 4y ago
  audited for what? what is this signal fanboyism online when there are competing products doing the same thing? if whatsapp is using signal protocol then by effect isn't it as secure as signal? if whatsapp is introducing attack vectors, then they are not as secure as signal. But all that is a moot point. Indian government wants a representative in india for all the apps which they can throw in the jail or fine or arrest or beat up if their app is used to disseminate information the ruling party finds unpalatable. There is no terrorism threat. If whatsapp is e2ee, why aren't criminals using it? one would argue that it is being monitored and anyone doing any terrorist activity gets auto reported so where is e2ee in this? what happened to that? the government wants element/threema/telegram/whatsapp/signal to have a rep who will give them backdoor access and dance to their tune or they will cut off their money supply viz a viz, ban from the huge indian market. Telegram and whatsapp have bowed down to the supreme clown so they are after the rest of the apps now. reproducibility is nothing if the government can't push down on someone's neck. They want a totalitarian state where any dissent is seen as a criminal offense and people are today in jails for doing that. public channels is nonsense argument. the boogeyman terrorists wont use public channels will they? second thing, there is no requirement of using a mobile number with matrix. That is an amazing tool with the indian government. They just need the account holders' mobile which whatsapp and telegram are happy to share to save their asses and it takes a matter of seconds to find the person. They then employ the "xkcd $5 wrench attack" and the game is over. These apps don't mandate the use of a mobile number so that is what they are after.
  - jraph 4y ago
    > audited for what? To find backdoors? > what is this signal fanboyism online when there are competing products doing the same thing? You are completely misreading me. I actually prefer Element/Matrix than Signal (and I use both). But that does not matter one bit, so I hadn't mentioned it so far. I'm a fanboy of nothing, that's not how I work. Take it easy. > if whatsapp is using signal protocol then by effect isn't it as secure as signal? WhatsApp is closed source. We only have Facebook's words for trusting it. Which is a bit weak if ask me.
    - 2Gkashmiri 4y ago
crnkovic 4y ago
> This is basically an indirect validation that most non listed messaging apps supposedly offering e2e encryption such as Whatsapp or Signal have backdoors with access from any government asking for access. More likely: the government doesn't want to cause 'too much' discomfort among ordinary citizens. The decision to not block popular apps such as WhatsApp is probably purely political.
- webmobdev 4y ago
  National security trumps "discomfort to citizens" every time ... otherwise all of us would have revolted by now for wasting hours in airport because of the security checks.
  - Kwpolska 4y ago
    When did you last see offline protests against airport security theater? Literally everyone in India is using WhatApp. If the government decided to shut it down, all government offices would be on fire within hours.
    - webmobdev 4y ago
      > When did you last see offline protests against airport security theater? Isn't that what I am saying too? We accept the huge discomfort because we feel it is important and in our national interest! However important WhatsApp is, it is just a platform. If it is killed by a ban, people will just migrate to another platform and that's a lot more easier to do than give up on the benefits of flying by air. The only reason WhatsApp is allowed to function is because they are willing to provide a backdoor to the indian government - and that's easy to do when all the communication goes through their server and they handle the keys.
  - Entinel 4y ago
    You actually don't understand the level of dependence India has on WhatsApp.
    - 4y ago
ishanjain28 4y ago
No, it's not
newhotelowner 4y ago
> Whatsapp Whatsapp is the bread and butter of this government. That's their biggest propaganda machine.
zug_zug 4y ago
Anything owned by Meta has a whole internal platform for serving government requests for many countries based on select criteria
tialaramex 4y ago
> This is basically an indirect validation that most non listed messaging apps supposedly offering e2e encryption such as Whatsapp or Signal have backdoors with access from any government asking for access. Spot the user who thinks the Christian apologist must be on to something because if the story doesn't make any sense that means it must be true...
mschuster91 4y ago
> This is basically an indirect validation that most non listed messaging apps supposedly offering e2e encryption such as Whatsapp or Signal have backdoors with access from any government asking for access. "Monitor activities" can also mean police investigators writing Telegram or whatever "hey, we found evidence that <illegal activity> is regularly occurring in channel ID X, here are the permanent links/IDs of example posts, please consider closing the channel or barring access to it from India or otherwise we will enforce compliance against the legal representative". It's basically the same stuff that the German NetzDG or the upcoming EU DSA/DMA laws are.
suyash 4y ago
Most of these sound like they are created for nefarious purpose such as terrorism or data hacking.
Klonoar 4y ago
This is the most eye roll inducing comment I’ve seen on this site this week. We know this isn’t the case.

deleted 4y ago

[deleted]

masklinn 4y ago

Is it? Or is it that they’re starting from clients with low usage rates & little to no backing, which would be easier to attack? And / or they’re going at it network bu network?

jraph 4y ago

> This is basically an indirect validation that most non listed messaging apps supposedly offering e2e encryption such as Whatsapp or Signal have backdoors with access from any government asking for access. Not really. At least, I'm not convinced. Signal for instance does not have public channels like Matrix has, maybe that's the big difference. Signal's code can also be audited if in doubt (well, actually, Signal could always provide altered binaries on the App Store and Google Play Store, you'd have to build it yourself to be sure - though they do have reproducible builds for Android [1]). [1] https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/

prmoustache 4y ago
How many people are: - auditing signal source code - recompiling the signal client to make sure they haven't tampered binaries. I remember a blog post from signal showing how to build a compilation environment to validate the source but it was itself relying on docker images that you should first rebuild yourself to make sure the compiler and any other dependencies are the same as the upstream ones.
- jraph 4y ago
  Sure. That's why I wrote "if in doubt". There was this statement that what's happening more or less proves that Signal & co has backdoors. That's a guess but the good thing is that we can check. It takes one person to do it. Not everybody has to do it. If I remember correctly, binaries sent to the Play Store are signed by the developer so Google can't really temper with the binary themselves, or they would need to modify Android so it ignores the problem. But at this point, this means Android itself is backdoored. (Which I don't exclude, btw - we need to trust a whole host of binaries for the phone drivers, and the hardware itself. At this point the issue is deeper than just signal though)
  - detuur 4y ago
    Also, if that were true, there wouldn't be a reason to ban Element or these other apps in the first place. Reproducible builds, combined with Android's developer-signed binaries, means that you don't _need_ to be super-vigilant to detect backdoors. You can investigate binaries after the fact (especially since virtually every version of popular apps is archived on third-party apk sites), and see that the signed build is not reproducible and at that point you can very easily dig into the binary to see which changes were made.
  - JeremyNT 4y ago
    I believe Google now can do the app signing. They seem to encourage developers to upload keys [0]. The stated reason is to generate dynamic packages based on device details. I don't remember the details but I believe it is their intention to eventually remove the ability for developers to sign their own packages. [0] https://developer.android.com/guide/app-bundle/faq https://developer.android.com/guide/app-bundle/faq
NayamAmarshe 4y ago
Nobody can verify backend code though, that's always an issue.
- jraph 4y ago
  Signal is e2ee. The point of e2ee is that you can not trust the backend code (except for clear data it actually manipulates - which is still an issue indeed - Message contents are encrypted though) This is the case for any e2ee solutions. For instance my company develops CryptPad [1], which is a full open source office suite with e2ee. The server admins can't access your content and you don't need to trust the backend, which just passes messages and store encrypted messages. This is the whole point. e2ee has drawbacks: it's very difficult, if not impossible, to provide indexed search for encrypted content on the server, the client needs to do it which might be impractical. [1] https://cryptpad.org/ https://cryptpad.org/
  - dadoomer 4y ago
    I really like cryptpad. Thank you for developing it. I have used it a few times in a professional setting even when there is no need for end-to-end encryption, and it is a good experience so far. I encourage others to try it .
  - NayamAmarshe 4y ago
    > Signal is e2ee. That still does not change anything though. The backend is unverifiable, that's a fact. Why talk about E2EE, I wasn't really talking about that. Signal for a whole year was running a different server code and nobody even could tell that they added some cryptocoin stuff. On top of that, metadata, server connection and anything other than the message content is all at the mercy of the server owner.
    - bentley 4y ago
      > On top of that, metadata, server connection and anything other than the message content is all at the mercy of the server owner. Except to the extent that the client is explicitly designed to minimize what metadata is exposed to the server.
2Gkashmiri 4y ago
audited for what? what is this signal fanboyism online when there are competing products doing the same thing? if whatsapp is using signal protocol then by effect isn't it as secure as signal? if whatsapp is introducing attack vectors, then they are not as secure as signal. But all that is a moot point. Indian government wants a representative in india for all the apps which they can throw in the jail or fine or arrest or beat up if their app is used to disseminate information the ruling party finds unpalatable. There is no terrorism threat. If whatsapp is e2ee, why aren't criminals using it? one would argue that it is being monitored and anyone doing any terrorist activity gets auto reported so where is e2ee in this? what happened to that? the government wants element/threema/telegram/whatsapp/signal to have a rep who will give them backdoor access and dance to their tune or they will cut off their money supply viz a viz, ban from the huge indian market. Telegram and whatsapp have bowed down to the supreme clown so they are after the rest of the apps now. reproducibility is nothing if the government can't push down on someone's neck. They want a totalitarian state where any dissent is seen as a criminal offense and people are today in jails for doing that. public channels is nonsense argument. the boogeyman terrorists wont use public channels will they? second thing, there is no requirement of using a mobile number with matrix. That is an amazing tool with the indian government. They just need the account holders' mobile which whatsapp and telegram are happy to share to save their asses and it takes a matter of seconds to find the person. They then employ the "xkcd $5 wrench attack" and the game is over. These apps don't mandate the use of a mobile number so that is what they are after.
- jraph 4y ago
  > audited for what? To find backdoors? > what is this signal fanboyism online when there are competing products doing the same thing? You are completely misreading me. I actually prefer Element/Matrix than Signal (and I use both). But that does not matter one bit, so I hadn't mentioned it so far. I'm a fanboy of nothing, that's not how I work. Take it easy. > if whatsapp is using signal protocol then by effect isn't it as secure as signal? WhatsApp is closed source. We only have Facebook's words for trusting it. Which is a bit weak if ask me.
  - 2Gkashmiri 4y ago

crnkovic 4y ago

> This is basically an indirect validation that most non listed messaging apps supposedly offering e2e encryption such as Whatsapp or Signal have backdoors with access from any government asking for access. More likely: the government doesn't want to cause 'too much' discomfort among ordinary citizens. The decision to not block popular apps such as WhatsApp is probably purely political.

webmobdev 4y ago
National security trumps "discomfort to citizens" every time ... otherwise all of us would have revolted by now for wasting hours in airport because of the security checks.
- Kwpolska 4y ago
  When did you last see offline protests against airport security theater? Literally everyone in India is using WhatApp. If the government decided to shut it down, all government offices would be on fire within hours.
  - webmobdev 4y ago
    > When did you last see offline protests against airport security theater? Isn't that what I am saying too? We accept the huge discomfort because we feel it is important and in our national interest! However important WhatsApp is, it is just a platform. If it is killed by a ban, people will just migrate to another platform and that's a lot more easier to do than give up on the benefits of flying by air. The only reason WhatsApp is allowed to function is because they are willing to provide a backdoor to the indian government - and that's easy to do when all the communication goes through their server and they handle the keys.
- Entinel 4y ago
  You actually don't understand the level of dependence India has on WhatsApp.
  - 4y ago

ishanjain28 4y ago

No, it's not

newhotelowner 4y ago

> Whatsapp Whatsapp is the bread and butter of this government. That's their biggest propaganda machine.

zug_zug 4y ago

Anything owned by Meta has a whole internal platform for serving government requests for many countries based on select criteria

tialaramex 4y ago

> This is basically an indirect validation that most non listed messaging apps supposedly offering e2e encryption such as Whatsapp or Signal have backdoors with access from any government asking for access. Spot the user who thinks the Christian apologist must be on to something because if the story doesn't make any sense that means it must be true...

mschuster91 4y ago

> This is basically an indirect validation that most non listed messaging apps supposedly offering e2e encryption such as Whatsapp or Signal have backdoors with access from any government asking for access. "Monitor activities" can also mean police investigators writing Telegram or whatever "hey, we found evidence that <illegal activity> is regularly occurring in channel ID X, here are the permanent links/IDs of example posts, please consider closing the channel or barring access to it from India or otherwise we will enforce compliance against the legal representative". It's basically the same stuff that the German NetzDG or the upcoming EU DSA/DMA laws are.

suyash 4y ago

Most of these sound like they are created for nefarious purpose such as terrorism or data hacking.

Klonoar 4y ago

This is the most eye roll inducing comment I’ve seen on this site this week. We know this isn’t the case.