7 ms·

France moves to break encrypted messaging

282 points by Cider9986 6mo ago

heinrich5991 6mo ago
This article incorrectly implies that Telegram is end-to-end encrypted, by putting it in the same line as WhatsApp and Signal. Telegram doesn't even try to be end-to-end-encrypted by default. WhatsApp claims to be end-to-end-encrypted, but it's not open-source, Signal is end-to-end-encrypted.
- hellcow 6mo ago
  > WhatsApp claims to be end-to-end-encrypted, but it's not open-source And explicitly does not encrypt metadata. Meanwhile NSA top brass publicly stated, "We kill people based on metadata."
  - 2ndorderthought 6mo ago
    I imagine in 2027 people will be getting killed over vibes. Does make you wonder what kind of people they kill or how many. I can't think of a lot of crimes whose metadata warrants being killed for personally.
    - xethos 6mo ago
      > I can't think of a lot of crimes whose metadata warrants being killed for personally You're (literally) missing links then. If A is a high-value target that we look at closely (because they're a high-value target), what if B frequently contacts A? If C, D, and E always recieve messages from B immediately following A messaging B? What about times? Is B messaging F at a consistant time, and never outside of that? Is A only messaging G, at a set time, with G's phone immediately being put into (ineffective) airplane mode immediately before and after? Facebook built their business on the social graph, but the CIA's been at this for decades
      - 2ndorderthought 6mo ago
        Thanks for explaining. I guess we are talking about espionage or something like that. I've been so focused on the rise of domestic surveillance lately that I forgot about the noncitizen aspects. Which is ridiculous but at the same time, it does seem like a trillion dollar focus lately.
        xethos 6mo ago
        My examples are all based on the CIA and NSA playbook though, as it was the NSA director that said the quiet part out loud, explicitly, in front of Congress. The NSA is effectively America's red team, an offensive arm, meaning they (should be) focused on threats (percieved or otherwise) outside the country The FBI has been much quieter about this though - there has yet to be a Snowden-for-the-FBI, though they would be one of the agencies I would fully expect to be doing similar work domestically. As this becomes more well-known, I would expect state and county police to start looking into data and metadata as well. In some cases, they already are [0] - even if some aspects of that case are less relevant today (Google Maps no longer uploads location history, though cell tower trilateration is getting more accurate, not less). It's far more prevalent than most people realize, though I invite you to consider which you'd rather have when building a second-by-second profile of a person's life: the message contents, or the metadata? [0] https://www.wired.com/story/find-my-iphone-arson-case/ https://www.wired.com/story/find-my-iphone-arson-case/
        2ndorderthought 6mo ago
        Metadata would be more powerful in 9 out of 10 cases. Message contents could be invaluable in some cases too. Interesting to think about
    - Projectiboga 6mo ago
      In the dystopian novel Nineteen Eighty-Four, thoughtcrime, also known as crimethink in the official language of Newspeak, is the offense of thinking in ways not approved by the ruling Ingsoc party. It describes the intellectual actions of a person who entertains and holds politically unacceptable thoughts; thus the government of The Party controls the speech, actions, and thoughts of the citizens of Oceania. https://en.wikipedia.org/wiki/Thoughtcrime https://en.wikipedia.org/wiki/Thoughtcrime
      - 2ndorderthought 6mo ago
        It's a great book! It does make you wonder what s future with neural link and data centers in every city looks like under a fascist regime.
    - tardedmeme 6mo ago
      Isn't this already happening? It's why the war department uses ChatGPT and Claude to target drone strikes. It's why Anthropic had to make a public scene to pretend that wasn't happening.
  - Razengan 6mo ago
    > Meanwhile NSA top brass publicly stated, "We kill people based on metadata. Can someone post a link to that?
    - LarsKrimi 6mo ago
      Maybe just search for it and pick a source you trust. Take the search term "kill people based on metadata" and no noise comes up, just tons of articles about General Hayden's interview and related
    - deleted 6mo ago
      [deleted]
    - ThePowerOfFuet 6mo ago
      Since you're too lazy to do even a precursory search: https://youtube.com/watch?v=NSaGl2uO5w https://youtube.com/watch?v=NSaGl2uO5w
      - Razengan 6mo ago
        Cause that sort of shit sounded like ambiguous clickbait
- em-bee 6mo ago
  telegram may not be end-to-end encrypted by default but it does support end-to-end encryption. the generous reading is that this encryption, if used, should be broken. so as i read it the article doesn't suggest that all of telegram is end-to-end encrypted only that it has support for it.
- wolvoleo 6mo ago
  Yes and the secret chats in telegram are super clumsy. Both parties need to be online at the same time for the key exchange, it only works on one device at each side. Nobody I know uses them. I sent some people a password reset through them but half of them couldn't get their head around it. So yeah while it has secret chats, they aren't very useful at all.
- riedel 6mo ago
  Open source would not help without the reproducible builds of Signal (I wonder who check them on each release?). And only builds like Molly include no binary blobs of Google [1], which could IMHO at least be used to extract some metadata. Leaving the OS still as a risk, even for Molly or Matrix clients. Even with transparency around linked devices, I would believe that few people would notice silently linked devices. Simplest thing is I guess social engineering which happened in a coordinated attack on Signal messagers of German politicians recently (I guess there should be an official signal app version not supporting linked devices for such people) [2]. [1] https://news.ycombinator.com/item?id=46081855 https://news.ycombinator.com/item?id=46081855 [2] https://www.politico.eu/article/hackers-attack-phone-of-german-parliament-president-julia-klockner/ https://www.politico.eu/article/hackers-attack-phone-of-germ...
  - adrianN 6mo ago
    Politicians should probably not use Signal but something that is controlled by the government and for example doesn’t allow „accidentally“ deleting incriminating messages.
    - rurban 6mo ago
      If politicians would be effectively controlled by the government and not by some independent party those mysterious, oops, accidentally deleted it problems would increase.
      - librasteve 6mo ago
        oh dear, my phone was stolen - Morgan McSweeney
    - ranger_danger 6mo ago
      > controlled by the government So they can spy on them directly?
tw04 6mo ago
I find it fascinating that a country with citizens that are typically willing to protest in the streets at the drop of a hat don't seem to care. Is it that they aren't technically literate?
- tensor 6mo ago
  These sorts of laws have repeatedly failed to pass in Europe due to people protesting. The government just keeps coming back and trying again it seems. What makes you think French citizens don’t care?
  - userbinator 6mo ago
    Maybe it's time for France to reconsider its relationship with the EU.
    - palata 6mo ago
      The French people typically elect far-right politicians to represent them at the EU level, so...
      - userbinator 6mo ago
        It's not about left or right, but up and down.
        0dayz 6mo ago
        That makes little sense if you know some basic political science, the EU is comprised of different political interest groups just like your country is. Unless you literally belive everyone in the EU belive the exact same thing and there's zero disagreements what do ever.
        shakow 6mo ago
        Kind of, at least in France? Our privacy-nefarious laws have been passed by both left- and right-leaning governments. It seems that if there is something the elite agrees upon, it is that the plebeians should be kept in check.
pessimizer 6mo ago
> Mass surveillance, of course, isn’t what the delegation is proposing. The fear isn’t that a French investigator will read every WhatsApp message. French investigators won't care about every WhatsApp message. But they definitely will slurp them all up, process them all with AI, and read them whenever they have an interest. And they will deny they are doing this as they do this.
- adrianwaj 6mo ago
  It will become more important over time - Telegram and the TON coin are reintegrating. So messaging surveillance is financial surveillance too? Price is going up too. https://x.com/BSCNews/status/2053046567930937817 https://x.com/BSCNews/status/2053046567930937817 Upgraded a month ago: https://x.com/durov/status/2042247948147241072 https://x.com/durov/status/2042247948147241072 It'd be interesting (horrifying?) to see something that was once assumed secret go public. Imagine if all chats and payments eventually went public at some point... the Transparity, when nothing can be encrypted anymore so no one tries. Mankind becomes a unit - or it devolves? With TON, perhaps altcoins will give way to micro coins - tailored especially for apps and their users/founders? ..for micropayments and running on AI infrastructure. Blockchain and AI infrastructure are already interchangeable in large part. So if transaction histories are exposed, the damage is limited. Startups won't look to IPO, they'll look to float a coin to make serious money. Binance did it. Polymarket next? Poly is dominated by Bitcoin as it stands. I'm not sure if Ethereum tokens would be the same thing.
  - fn-mote 6mo ago
    > […] something that was once assumed secret go public. Imagine if all chats and […] went public I strongly suspect instead that you would see Polymarket-style insider trading by the few powerful people who have access to the secrets.
    - adrianwaj 6mo ago
      Yeah, you would also have to trust Poly staff and media outlets. But also messaging platforms whereby wiretapping has never been so lucrative. So what's the CEO of ____ saying about an IPO? https://kalshi.com/markets/kxipo/ipos/kxipo-26 https://kalshi.com/markets/kxipo/ipos/kxipo-26 Time to get friendly with the 'tappers or become one oneself, right? This news story is so pertinent. Doctor Evil's secret AI prompt >> Train on messaging and then tell me the most lucrative bets in the prediction markets.
jmclnx 6mo ago
Lets pretend this happens, I am curious how it would work. So a person in Canada messages someone in France who's WhatsApp is not encrypted. But the message from Canada is encrypted. Will the person in Canada's message have to be sent unencrypted ? Or will WhatsApp Canada need to allow France to break Canada's encryption ? Personally I think it would be easier for these apps to ban people in France from using their service.
- EMIRELADERO 6mo ago
  They would have used the "ghost user" strategy. > "Perrin now offers a different framing. “Article 8 ter, which I had adopted, was not at all aimed at obtaining encryption keys but at introducing a ghost participant into a conversation before encryption,” he says. The “ghost participant” approach, sometimes called a ghost user proposal, was floated by GCHQ in 2018 and rejected by every major privacy organization, civil liberties group, and security researcher who looked at it. The idea is that the platform silently adds a third recipient, an invisible intelligence agent, to a supposedly two-person conversation. Users never see them. The encryption technically still works, except that one of the parties is the state."
  - deleted 6mo ago
    [deleted]
sublimefire 6mo ago
Some people do not take no for an answer. This is bordering on absurd. But on the other side what I miss is some explanation if forensic analysis helps here? Presumably the messages stay on a phone and you can recover them. If that is the case then it should be enough to fight the crime, i.e if you get a warrant to access the device then you can access messages, which I believe many would agree is fine.
TacticalCoder 6mo ago
To make the link with another very successful article on HN today: who is Franced rule by yet? By cyber-libertarians right?
croes 6mo ago
Let’s start with the smartphones of politicians.
- wolvoleo 6mo ago
  They already excluded themselves in the chatcontrol proposals. Typical.
amarant 6mo ago
I'm starting to think we need to make encryption a protected class, so that we can label speaking against it as hate speech. Let's start putting some of these politicians in jail for being stupid.
- petre 6mo ago
  How about let's not vote for stupid politicians?
  - M95D 6mo ago
    They're all stupid.
uriahlight 6mo ago
"The excessive increase of anything often causes a reaction in the opposite direction; and this is the case with freedom, which in a democracy often descends into anarchy... The excessive liberty of the individual in a democracy eventually leads to a desire for authoritarian rule, and out of that desire, the tyrant arises." - Plato's Republic
- dweinus 6mo ago
  No fair, we didn't even get the fun anarchy part before skipping right on to tyrrany!
- Nasrudith 6mo ago
  Oh look, an aristocrat patron sponsored is big into aristocracy, what a surprise.
EGreg 6mo ago
One of many simultaneous attempts all around the world: https://community.qbix.com/t/the-global-war-on-end-to-end-encryption/214 https://community.qbix.com/t/the-global-war-on-end-to-end-en... And by the way, this article mentions other things already in place, such as being able to commandeer your device and spy on it without breaking encryption: https://community.qbix.com/t/increasing-state-of-surveillance-from-all-sides-around-the-world/804 https://community.qbix.com/t/increasing-state-of-surveillanc...
31337Logic 6mo ago
[flagged]
- wolvoleo 6mo ago
  I wish it was just France. That's the problem.
hilbert42 6mo ago
Seems to me we're going to have to let the anti-encryption mob have their way until things go wrong—bigtime. No amount of expert advice will convince them until they witness firsthand the negative consequences of weakening encryption. It's only afterwards and as a consequence some highly newsworthy disasters occur such as a child abduction or political sex scandal involving a high profile politician come to light that the lay public will get the message that weak encryption is effectively no encryption. In the meantime criminals will be early adopters of more sophisticated messaging such as steganography.
- xingped 6mo ago
  Would be nice, but you know they'll carve out exceptions for themselves or use "unauthorized" messaging channels regardless with no consequences. It is _always_ "rules for thee, not for me" with politicians.
- Mars008 6mo ago
  > Seems to me we're going to have to let the anti-encryption mob have their way until things go wrong—bigtime. Been there, seen that. That's how Pakistan got nuclear bomb. France was just making friends.
  - rurban 6mo ago
    England gave Pakistan the nuclear bomb. Churchill's "greatest" idea
- BrenBarn 6mo ago
  In most cases I think the revelation of a scandal involving a high-profile politician would be a good thing. (That is, better than it remaining secret.)
- Razengan 6mo ago
  > until they witness firsthand the negative consequences of weakening encryption. They won't be affected. The hitherto invisible but very real wall between social classes is just going to become more visible for "First World" civilians the way it's been in "lesser" countries for decades already. Actual "criminals" have always been able to get around all the restrictions ever put in place since the dawn of civilization, it's just the common folk that get trodded on and kept in their place.
skiing_crawling 6mo ago
How will they know what's encrypted? Maybe I just like sending random sequences of bytes across the wire
- vkou 6mo ago
  I'm sure the judge will love your explanation.
  - tardedmeme 6mo ago
    In my home directory is a 4GB random file. I suggest you should do this too. Vary the filename to taste. Some suggestions: the name of any active drug market or cyber threat actor.
    - deleted 6mo ago
      [deleted]
    - dorgo 6mo ago
      I came about a Google subscription which includes 2TB of storage. I filled it with crypto noise (ok, Gemini did it for me). I couldn't let it be unused. Will have to delete it when the subscriptions runs out.
- sufficientsoup 6mo ago
  It doesn't even need to be random. What if you send an instance of a proprietary file format? Is the company required to share the spec and toolchain so that the govt can verify it (probably) isn't an encrypted message?
  - deeringc 6mo ago
    Exactly - or encrypted payloads hiding inside standard image file formats. Basically steganography. If all you want to send is a small encrypted text message, it should be possible to hide that in a large image (encoding in the LSB or whatever) in just a small percentage of pixels so that it doesn't fail statistical tests and is indistinguishable from real noise.
idiotsecant 6mo ago
The world needs frontiers or stuff like this is the natural state.
nazcan 6mo ago
I still don't understand the note that the companies can't decrypt the messages with e2e encryption. Isn't it as simple as a software update that says: "If user = foo, then send the on device keys elsewhere"? Or if those keys are part of a TPM, then a software update that just asks it to send in the decrypted messages? Can judges not order this now, but can order decryption if the keys are stored centrally?
- bsaul 6mo ago
  of course, nothing magically prevents the app from sending keys or decrypted content to a third party. That's why if you're really serious about e2ee you have to install the app from source.
  - antiframe 6mo ago
    I like to co-opt the expression: not your keys, not your privacy.
  - nazcan 6mo ago
    Yeah, makes sense. I wonder if for closed-source apps if governments can not just force the key collection the same way they would force decryption with centralized keys.
wewewedxfgdf 6mo ago
But not for French politicians and military, am I right? Encryption for me not for thee?
iamnothere 6mo ago
Time to teach all your friends how to use a one-time pad. Could be a fun hobby for those with the right inclination.
- qingcharles 6mo ago
  It's not clear that this would be a legal workaround. Even texting in rare languages, like those in Egyptian hieroglyphs, or perhaps Klingon, might warrant a knock on your door.
  - iamnothere 6mo ago
    At that point you may as well stop worrying about the knock, assume it will come regardless, and start organizing resistance. When all means for private communication are cut off, broader oppression isn’t far behind.
Mars008 6mo ago
The big problem here is that Veracrypt development is done there if I'm not mistaken. Probably time to get back to trusted old TrueCrypt.
budududuroiu 6mo ago
I'll repeat this over and over: Most EU politicians are aware of needing to lead from positions of deep unpopularity for the next 10-20 years, they're just setting the stage to have the tools to suppress dissent at their disposal. After encryption, my bet is on reduced rights to protest (see UK wanting to ban protests that repeatedly "cause disruption").
- leonidasrup 6mo ago
  EU politicians are still more popular than Russian politicians.
- sunshine-o 6mo ago
  Yes, all the Mertz, Macron, Starmer and unelected Brussels ones have officially about 10-20% approval rating. This is in fact mind boggling and I am still wondering how it is even possible. My guess is most of those positive approval are boomers who watch TV and are less impacted by their policies because they own their house and receive their retirements, they are highly incentivised to keep the train going. Or people who directly benefit from their policies. What I still can't explain is Trump can still maintain a much higher approval ratings with in a country with similar demographic profile, even after literally doing the exact opposite than he promised. So my guess is the support for the current system and the people running it in Europe is probably less than 5% among the population who will still be around in 10-20 years. So the current political system is literally levitating on a cloud of old people which is disappearing at a rate of about 10% per year. So one way or another this is gonna get ugly.
  - deleted 6mo ago
    [deleted]
ZetsuBouKyo 6mo ago
I remember a joke where a guy sent a joke to another via private message, and Xi Jinping laughed. It seems the government's mindset is the same everywhere.
Razengan 6mo ago
With the first link, the chain is forged. We're into way many links already. Isn't this the country that beheaded their rulers?
fithisux 6mo ago
A public ballot should be held for this. Governments act as kings.
sMarsIntruder 6mo ago
Liberté, Égalité, Fraternité.. et Surveillance-té
alkindiffie 6mo ago
So in France you will not be able to send your friend gibberish text that only you and your friend understand. Will they also ban the ability to make new languages that only you and your friends understand. Will they also ban whispering?
- tonis2 6mo ago
  Yes, to protect the children ofcourse.
- deleted 6mo ago
  [deleted]
- trolleski 6mo ago
  But how can they be SURE that you are not a terrorist? Neuralink is the only option!
  - baranul 6mo ago
    Unknown associations and free speech are too scary. Neuralink and continual surveillance for the win. Pre-crime units at the ready.
- deleted 6mo ago
  [deleted]
- baranul 6mo ago
  Well, if it is some gibberish between you and friends the state doesn't understand, they will have you silently and continually investigated by a pre-crime unit. You and your friends could be committing "thought-crime".
  - ykonstant 6mo ago
    But I thought crime--- - He said thought crime! bots start firing the machine guns
- phyzix5761 6mo ago
jemmyw 6mo ago
The article is a lot more nuanced than the title or what most folks are discussing in comments. France has politicians voting in both directions and thus far the "keep encryption and enshrine it in law" side is ahead slightly. > Senator Olivier Cadic, of the Centrist Union, secured an amendment to a separate bill on critical infrastructure resilience and cybersecurity that would do the opposite, writing encryption protection into French law and prohibiting any obligation on messaging services to install backdoors. The Senate adopted it in March 2025.
- nickslaughter02 6mo ago
  > His bill was examined in committee at the National Assembly in September and has been stalled since.
motbus3 6mo ago
I wonder if they remove encryption how can they ensure who are the authors. Will they still apply all the certificates?
- hulitu 6mo ago
  You no underestand. They will remove "encryption" but they will not remove the certificates. They learned from the CIA: Who controls certificates, controls the past.
kkfx 6mo ago
The nazi drop more and more the mask. Yet most still not wake up... BTW France already have - https://gizmodo.com/france-bill-allows-police-access-phones-camera-gps-1850609772 https://gizmodo.com/france-bill-allows-police-access-phones-... - https://www.medias-presse.info/une-nouvelle-loi-de-programmation-militaire-permettant-a-letat-de-requisitionner-tout-ce-quil-veut https://www.medias-presse.info/une-nouvelle-loi-de-programma... can't find one in English Plus - https://fr.wikipedia.org/wiki/Loi_renfor%C3%A7ant_la_s%C3%A9curit%C3%A9_int%C3%A9rieure_et_la_lutte_contre_le_terrorisme https://fr.wikipedia.org/wiki/Loi_renfor%C3%A7ant_la_s%C3%A9... - https://fr.wikipedia.org/wiki/Projet_de_loi_visant_%C3%A0_s%C3%A9curiser_et_r%C3%A9guler_l%27espace_num%C3%A9rique https://fr.wikipedia.org/wiki/Projet_de_loi_visant_%C3%A0_s%... - https://fr.wikipedia.org/wiki/Loi_tendant_%C3%A0_renforcer_la_pr%C3%A9vention_et_la_r%C3%A9pression_des_mouvements_sectaires https://fr.wikipedia.org/wiki/Loi_tendant_%C3%A0_renforcer_l... Essentially China is already here.
Canada 6mo ago
[flagged]
kmfrk 6mo ago
Chat Control refuses to die.
bgr-co 6mo ago
Hello, I am French and, with many others, fighting this. It is still a fight - no law is enacted yet - and it is not the first time we have to fight this. To state how utterly ridiculous these politicians are, ANSSI itself - the national cybersecurity agency- published a paper in 2016 clearly explaining why backdooring encryption in messaging apps is both dangerous and useless (https://www.developpez.com/actu/102152/France-l-ANSSI-se-dit-en-faveur-du-chiffrement-et-contre-l-installation-de-portes-derobees-dans-une-missive-adressee-a-plusieurs-ministeres/ https://www.developpez.com/actu/102152/France-l-ANSSI-se-dit...) This position has been clearly restated in 2025 by Guillaume Poupard, a former highly acclaimed ANSSI boss and a cryptographer.
fyltr 6mo ago
I have talked about it with a high-ranking french policeman. That person is mostly active in fighting sex-crimes on children, which is the angle I will mostly be referring to. From what I understood, it is very clear to them that even if these laws comes to pass, a good amount of criminal activities will move to other safer options. However, the general criminal is not technically competent. Currently, with WhatsApp providing end-to-end by default, access to pedophilic content is extremely simple. By suppressing these simple means of end to end encryption, the goal is to reduce the amount of people accessing these networks due to a higher entry bar. What's of course concerning is that it renders anyone using encryption suspect, which includes pedophiles and narcotrafficants, but also activists and co. Also, if we're only targetting pedophile networks, one option that comes to mind to me is the following : Most of those images are known and have been circulating for a while. By hashing any sent images and comparing them to the checksum of known ones, one could easily flag suspicions senders and proceed to access the phones of those users. Does that seem feasible to you or am I missing something?
- spwa4 6mo ago
  First, the French state has zero interest in access to these messages to help children. The proof: NEITHER the French police NOR the secret service investigate child abuse cases. The police only investigates them if they absolutely can't avoid it, because mostly people with access to children commit child abuse. You will find child abuse requires a child. In other words, who does that? Teachers, sports teachers and coaches and child welfare workers (sports clubs are almost exclusively government funded in France). The large majority of the perpetrators, of course, are government employees. Child services investigates child abuse cases, and WILL NOT get access to these messages. So there is zero intention to give access to messages in child abuse cases. I mean how ridiculous is this argument. They want access to such messages to investigate child abuse cases, so they demand French spies, and tax investigators get access to everyone's messages ... Child abuse investigators are not even mentioned. And it's not just that. Next, France is famous in Western Europe for being one of the only EU countries where access to, uh, hentai comics, is legal and they're sold in newspaper stands. If the French state cared about fighting sex-crimes on children they would fund taking care of the children they do "help", rather than catching criminals. Instead, this is what they do: https://www.rfi.fr/en/france/20250502-french-child-welfare-service-accused-of-allowing-kids-to-fall-into-prostitution https://www.rfi.fr/en/france/20250502-french-child-welfare-s... (at the very least they let it happen, but in practice they also hire people that will do this job at a very cheap wage because it provides access to vulnerable children) Without fixing this FIRST, the only thing catching criminals will do, obviously, is make the situation of children worse. The French state fails this test. The situation with French schools, both the immigrant situation AND the constant decline in teacher quality (for at least 3 decades now) show how much the state cares about children's future in general. Again, the state fails the test completely. And I haven't even mentioned the refugee situation in Paris. Obviously that situation is producing a flood of child prostitution. Again, the state is showing itself unwilling to help children. Again, the French state is exposed as not doing shit to help children, or at the very least, they're totally ineffective. So no, and sorry to state the obvious, but your suggestion is completely beside the point.
mmooss 6mo ago
> The “ghost participant” approach, sometimes called a ghost user proposal, was floated by GCHQ in 2018 and rejected by every major privacy organization, civil liberties group, and security researcher who looked at it. The idea is that the platform silently adds a third recipient, an invisible intelligence agent, to a supposedly two-person conversation. Users never see them. / The encryption technically still works, except that one of the parties is the state. It's an innovative idea. What defenses against this attack are in WhatsApp, Signal, etc. right now? (In any situation, attackers can attack endpoints: If they can see what the user sees, apps and encryption don't matter. They could attack remotely, or in the case of higher-interest targets, physically.) First, does the service mediate the group chat? If the messaging is peer-to-peer [0] with no server mediating, then someone would of course need to attack a peer as described above. I know Signal supposedly has no metadata, including chat participants; I don't know what mediation they do. If the service does mediate the chat somehow, then an attacker could theoretically add themselves to the group. Hiding - the 'ghost' part - from the rest of the group seems trickier, but maybe that's also possible server-side. [0] 5 users doing a mesh of multicast peer-to-peer video sounds like a utilization and quality nightmare.
harrisaydin77 6mo ago
[flagged]

282 points by Cider9986 6mo ago

This article incorrectly implies that Telegram is end-to-end encrypted, by putting it in the same line as WhatsApp and Signal. Telegram doesn't even try to be end-to-end-encrypted by default. WhatsApp claims to be end-to-end-encrypted, but it's not open-source, Signal is end-to-end-encrypted.

hellcow 6mo ago
> WhatsApp claims to be end-to-end-encrypted, but it's not open-source And explicitly does not encrypt metadata. Meanwhile NSA top brass publicly stated, "We kill people based on metadata."
- 2ndorderthought 6mo ago
  I imagine in 2027 people will be getting killed over vibes. Does make you wonder what kind of people they kill or how many. I can't think of a lot of crimes whose metadata warrants being killed for personally.
  - xethos 6mo ago
    > I can't think of a lot of crimes whose metadata warrants being killed for personally You're (literally) missing links then. If A is a high-value target that we look at closely (because they're a high-value target), what if B frequently contacts A? If C, D, and E always recieve messages from B immediately following A messaging B? What about times? Is B messaging F at a consistant time, and never outside of that? Is A only messaging G, at a set time, with G's phone immediately being put into (ineffective) airplane mode immediately before and after? Facebook built their business on the social graph, but the CIA's been at this for decades
    - 2ndorderthought 6mo ago
      Thanks for explaining. I guess we are talking about espionage or something like that. I've been so focused on the rise of domestic surveillance lately that I forgot about the noncitizen aspects. Which is ridiculous but at the same time, it does seem like a trillion dollar focus lately.
      - xethos 6mo ago
        My examples are all based on the CIA and NSA playbook though, as it was the NSA director that said the quiet part out loud, explicitly, in front of Congress. The NSA is effectively America's red team, an offensive arm, meaning they (should be) focused on threats (percieved or otherwise) outside the country The FBI has been much quieter about this though - there has yet to be a Snowden-for-the-FBI, though they would be one of the agencies I would fully expect to be doing similar work domestically. As this becomes more well-known, I would expect state and county police to start looking into data and metadata as well. In some cases, they already are [0] - even if some aspects of that case are less relevant today (Google Maps no longer uploads location history, though cell tower trilateration is getting more accurate, not less). It's far more prevalent than most people realize, though I invite you to consider which you'd rather have when building a second-by-second profile of a person's life: the message contents, or the metadata? [0] https://www.wired.com/story/find-my-iphone-arson-case/ https://www.wired.com/story/find-my-iphone-arson-case/
        2ndorderthought 6mo ago
        Metadata would be more powerful in 9 out of 10 cases. Message contents could be invaluable in some cases too. Interesting to think about
  - Projectiboga 6mo ago
    In the dystopian novel Nineteen Eighty-Four, thoughtcrime, also known as crimethink in the official language of Newspeak, is the offense of thinking in ways not approved by the ruling Ingsoc party. It describes the intellectual actions of a person who entertains and holds politically unacceptable thoughts; thus the government of The Party controls the speech, actions, and thoughts of the citizens of Oceania. https://en.wikipedia.org/wiki/Thoughtcrime https://en.wikipedia.org/wiki/Thoughtcrime
    - 2ndorderthought 6mo ago
      It's a great book! It does make you wonder what s future with neural link and data centers in every city looks like under a fascist regime.
  - tardedmeme 6mo ago
    Isn't this already happening? It's why the war department uses ChatGPT and Claude to target drone strikes. It's why Anthropic had to make a public scene to pretend that wasn't happening.
- Razengan 6mo ago
  > Meanwhile NSA top brass publicly stated, "We kill people based on metadata. Can someone post a link to that?
  - LarsKrimi 6mo ago
    Maybe just search for it and pick a source you trust. Take the search term "kill people based on metadata" and no noise comes up, just tons of articles about General Hayden's interview and related
  - deleted 6mo ago
    [deleted]
  - ThePowerOfFuet 6mo ago
    Since you're too lazy to do even a precursory search: https://youtube.com/watch?v=NSaGl2uO5w https://youtube.com/watch?v=NSaGl2uO5w
    - Razengan 6mo ago
      Cause that sort of shit sounded like ambiguous clickbait
em-bee 6mo ago
telegram may not be end-to-end encrypted by default but it does support end-to-end encryption. the generous reading is that this encryption, if used, should be broken. so as i read it the article doesn't suggest that all of telegram is end-to-end encrypted only that it has support for it.
wolvoleo 6mo ago
Yes and the secret chats in telegram are super clumsy. Both parties need to be online at the same time for the key exchange, it only works on one device at each side. Nobody I know uses them. I sent some people a password reset through them but half of them couldn't get their head around it. So yeah while it has secret chats, they aren't very useful at all.
riedel 6mo ago
Open source would not help without the reproducible builds of Signal (I wonder who check them on each release?). And only builds like Molly include no binary blobs of Google [1], which could IMHO at least be used to extract some metadata. Leaving the OS still as a risk, even for Molly or Matrix clients. Even with transparency around linked devices, I would believe that few people would notice silently linked devices. Simplest thing is I guess social engineering which happened in a coordinated attack on Signal messagers of German politicians recently (I guess there should be an official signal app version not supporting linked devices for such people) [2]. [1] https://news.ycombinator.com/item?id=46081855 https://news.ycombinator.com/item?id=46081855 [2] https://www.politico.eu/article/hackers-attack-phone-of-german-parliament-president-julia-klockner/ https://www.politico.eu/article/hackers-attack-phone-of-germ...
- adrianN 6mo ago
  Politicians should probably not use Signal but something that is controlled by the government and for example doesn’t allow „accidentally“ deleting incriminating messages.
  - rurban 6mo ago
    If politicians would be effectively controlled by the government and not by some independent party those mysterious, oops, accidentally deleted it problems would increase.
    - librasteve 6mo ago
      oh dear, my phone was stolen - Morgan McSweeney
  - ranger_danger 6mo ago
    > controlled by the government So they can spy on them directly?

tw04 6mo ago

I find it fascinating that a country with citizens that are typically willing to protest in the streets at the drop of a hat don't seem to care. Is it that they aren't technically literate?

tensor 6mo ago
These sorts of laws have repeatedly failed to pass in Europe due to people protesting. The government just keeps coming back and trying again it seems. What makes you think French citizens don’t care?
- userbinator 6mo ago
  Maybe it's time for France to reconsider its relationship with the EU.
  - palata 6mo ago
    The French people typically elect far-right politicians to represent them at the EU level, so...
    - userbinator 6mo ago
      It's not about left or right, but up and down.
      - 0dayz 6mo ago
        That makes little sense if you know some basic political science, the EU is comprised of different political interest groups just like your country is. Unless you literally belive everyone in the EU belive the exact same thing and there's zero disagreements what do ever.
        shakow 6mo ago
        Kind of, at least in France? Our privacy-nefarious laws have been passed by both left- and right-leaning governments. It seems that if there is something the elite agrees upon, it is that the plebeians should be kept in check.

pessimizer 6mo ago

> Mass surveillance, of course, isn’t what the delegation is proposing. The fear isn’t that a French investigator will read every WhatsApp message. French investigators won't care about every WhatsApp message. But they definitely will slurp them all up, process them all with AI, and read them whenever they have an interest. And they will deny they are doing this as they do this.

adrianwaj 6mo ago
It will become more important over time - Telegram and the TON coin are reintegrating. So messaging surveillance is financial surveillance too? Price is going up too. https://x.com/BSCNews/status/2053046567930937817 https://x.com/BSCNews/status/2053046567930937817 Upgraded a month ago: https://x.com/durov/status/2042247948147241072 https://x.com/durov/status/2042247948147241072 It'd be interesting (horrifying?) to see something that was once assumed secret go public. Imagine if all chats and payments eventually went public at some point... the Transparity, when nothing can be encrypted anymore so no one tries. Mankind becomes a unit - or it devolves? With TON, perhaps altcoins will give way to micro coins - tailored especially for apps and their users/founders? ..for micropayments and running on AI infrastructure. Blockchain and AI infrastructure are already interchangeable in large part. So if transaction histories are exposed, the damage is limited. Startups won't look to IPO, they'll look to float a coin to make serious money. Binance did it. Polymarket next? Poly is dominated by Bitcoin as it stands. I'm not sure if Ethereum tokens would be the same thing.
- fn-mote 6mo ago
  > […] something that was once assumed secret go public. Imagine if all chats and […] went public I strongly suspect instead that you would see Polymarket-style insider trading by the few powerful people who have access to the secrets.
  - adrianwaj 6mo ago
    Yeah, you would also have to trust Poly staff and media outlets. But also messaging platforms whereby wiretapping has never been so lucrative. So what's the CEO of ____ saying about an IPO? https://kalshi.com/markets/kxipo/ipos/kxipo-26 https://kalshi.com/markets/kxipo/ipos/kxipo-26 Time to get friendly with the 'tappers or become one oneself, right? This news story is so pertinent. Doctor Evil's secret AI prompt >> Train on messaging and then tell me the most lucrative bets in the prediction markets.

jmclnx 6mo ago

Lets pretend this happens, I am curious how it would work. So a person in Canada messages someone in France who's WhatsApp is not encrypted. But the message from Canada is encrypted. Will the person in Canada's message have to be sent unencrypted ? Or will WhatsApp Canada need to allow France to break Canada's encryption ? Personally I think it would be easier for these apps to ban people in France from using their service.

EMIRELADERO 6mo ago
They would have used the "ghost user" strategy. > "Perrin now offers a different framing. “Article 8 ter, which I had adopted, was not at all aimed at obtaining encryption keys but at introducing a ghost participant into a conversation before encryption,” he says. The “ghost participant” approach, sometimes called a ghost user proposal, was floated by GCHQ in 2018 and rejected by every major privacy organization, civil liberties group, and security researcher who looked at it. The idea is that the platform silently adds a third recipient, an invisible intelligence agent, to a supposedly two-person conversation. Users never see them. The encryption technically still works, except that one of the parties is the state."
- deleted 6mo ago
  [deleted]

sublimefire 6mo ago

Some people do not take no for an answer. This is bordering on absurd. But on the other side what I miss is some explanation if forensic analysis helps here? Presumably the messages stay on a phone and you can recover them. If that is the case then it should be enough to fight the crime, i.e if you get a warrant to access the device then you can access messages, which I believe many would agree is fine.

TacticalCoder 6mo ago

To make the link with another very successful article on HN today: who is Franced rule by yet? By cyber-libertarians right?

croes 6mo ago

Let’s start with the smartphones of politicians.

wolvoleo 6mo ago
They already excluded themselves in the chatcontrol proposals. Typical.

amarant 6mo ago

I'm starting to think we need to make encryption a protected class, so that we can label speaking against it as hate speech. Let's start putting some of these politicians in jail for being stupid.

petre 6mo ago
How about let's not vote for stupid politicians?
- M95D 6mo ago
  They're all stupid.

uriahlight 6mo ago

"The excessive increase of anything often causes a reaction in the opposite direction; and this is the case with freedom, which in a democracy often descends into anarchy... The excessive liberty of the individual in a democracy eventually leads to a desire for authoritarian rule, and out of that desire, the tyrant arises." - Plato's Republic

dweinus 6mo ago
No fair, we didn't even get the fun anarchy part before skipping right on to tyrrany!
Nasrudith 6mo ago
Oh look, an aristocrat patron sponsored is big into aristocracy, what a surprise.

EGreg 6mo ago

One of many simultaneous attempts all around the world: https://community.qbix.com/t/the-global-war-on-end-to-end-encryption/214 https://community.qbix.com/t/the-global-war-on-end-to-end-en... And by the way, this article mentions other things already in place, such as being able to commandeer your device and spy on it without breaking encryption: https://community.qbix.com/t/increasing-state-of-surveillance-from-all-sides-around-the-world/804 https://community.qbix.com/t/increasing-state-of-surveillanc...

31337Logic 6mo ago

[flagged]

wolvoleo 6mo ago
I wish it was just France. That's the problem.

hilbert42 6mo ago

Seems to me we're going to have to let the anti-encryption mob have their way until things go wrong—bigtime. No amount of expert advice will convince them until they witness firsthand the negative consequences of weakening encryption. It's only afterwards and as a consequence some highly newsworthy disasters occur such as a child abduction or political sex scandal involving a high profile politician come to light that the lay public will get the message that weak encryption is effectively no encryption. In the meantime criminals will be early adopters of more sophisticated messaging such as steganography.

xingped 6mo ago
Would be nice, but you know they'll carve out exceptions for themselves or use "unauthorized" messaging channels regardless with no consequences. It is _always_ "rules for thee, not for me" with politicians.
Mars008 6mo ago
> Seems to me we're going to have to let the anti-encryption mob have their way until things go wrong—bigtime. Been there, seen that. That's how Pakistan got nuclear bomb. France was just making friends.
- rurban 6mo ago
  England gave Pakistan the nuclear bomb. Churchill's "greatest" idea
BrenBarn 6mo ago
In most cases I think the revelation of a scandal involving a high-profile politician would be a good thing. (That is, better than it remaining secret.)
Razengan 6mo ago
> until they witness firsthand the negative consequences of weakening encryption. They won't be affected. The hitherto invisible but very real wall between social classes is just going to become more visible for "First World" civilians the way it's been in "lesser" countries for decades already. Actual "criminals" have always been able to get around all the restrictions ever put in place since the dawn of civilization, it's just the common folk that get trodded on and kept in their place.

skiing_crawling 6mo ago

How will they know what's encrypted? Maybe I just like sending random sequences of bytes across the wire

vkou 6mo ago
I'm sure the judge will love your explanation.
- tardedmeme 6mo ago
  In my home directory is a 4GB random file. I suggest you should do this too. Vary the filename to taste. Some suggestions: the name of any active drug market or cyber threat actor.
  - deleted 6mo ago
    [deleted]
  - dorgo 6mo ago
    I came about a Google subscription which includes 2TB of storage. I filled it with crypto noise (ok, Gemini did it for me). I couldn't let it be unused. Will have to delete it when the subscriptions runs out.
sufficientsoup 6mo ago
It doesn't even need to be random. What if you send an instance of a proprietary file format? Is the company required to share the spec and toolchain so that the govt can verify it (probably) isn't an encrypted message?
- deeringc 6mo ago
  Exactly - or encrypted payloads hiding inside standard image file formats. Basically steganography. If all you want to send is a small encrypted text message, it should be possible to hide that in a large image (encoding in the LSB or whatever) in just a small percentage of pixels so that it doesn't fail statistical tests and is indistinguishable from real noise.

idiotsecant 6mo ago

The world needs frontiers or stuff like this is the natural state.

nazcan 6mo ago

I still don't understand the note that the companies can't decrypt the messages with e2e encryption. Isn't it as simple as a software update that says: "If user = foo, then send the on device keys elsewhere"? Or if those keys are part of a TPM, then a software update that just asks it to send in the decrypted messages? Can judges not order this now, but can order decryption if the keys are stored centrally?

bsaul 6mo ago
of course, nothing magically prevents the app from sending keys or decrypted content to a third party. That's why if you're really serious about e2ee you have to install the app from source.
- antiframe 6mo ago
  I like to co-opt the expression: not your keys, not your privacy.
- nazcan 6mo ago
  Yeah, makes sense. I wonder if for closed-source apps if governments can not just force the key collection the same way they would force decryption with centralized keys.

wewewedxfgdf 6mo ago

But not for French politicians and military, am I right? Encryption for me not for thee?

iamnothere 6mo ago

Time to teach all your friends how to use a one-time pad. Could be a fun hobby for those with the right inclination.

qingcharles 6mo ago
It's not clear that this would be a legal workaround. Even texting in rare languages, like those in Egyptian hieroglyphs, or perhaps Klingon, might warrant a knock on your door.
- iamnothere 6mo ago
  At that point you may as well stop worrying about the knock, assume it will come regardless, and start organizing resistance. When all means for private communication are cut off, broader oppression isn’t far behind.

Mars008 6mo ago

The big problem here is that Veracrypt development is done there if I'm not mistaken. Probably time to get back to trusted old TrueCrypt.

budududuroiu 6mo ago

I'll repeat this over and over: Most EU politicians are aware of needing to lead from positions of deep unpopularity for the next 10-20 years, they're just setting the stage to have the tools to suppress dissent at their disposal. After encryption, my bet is on reduced rights to protest (see UK wanting to ban protests that repeatedly "cause disruption").

leonidasrup 6mo ago
EU politicians are still more popular than Russian politicians.
sunshine-o 6mo ago
Yes, all the Mertz, Macron, Starmer and unelected Brussels ones have officially about 10-20% approval rating. This is in fact mind boggling and I am still wondering how it is even possible. My guess is most of those positive approval are boomers who watch TV and are less impacted by their policies because they own their house and receive their retirements, they are highly incentivised to keep the train going. Or people who directly benefit from their policies. What I still can't explain is Trump can still maintain a much higher approval ratings with in a country with similar demographic profile, even after literally doing the exact opposite than he promised. So my guess is the support for the current system and the people running it in Europe is probably less than 5% among the population who will still be around in 10-20 years. So the current political system is literally levitating on a cloud of old people which is disappearing at a rate of about 10% per year. So one way or another this is gonna get ugly.
- deleted 6mo ago
  [deleted]

ZetsuBouKyo 6mo ago

I remember a joke where a guy sent a joke to another via private message, and Xi Jinping laughed. It seems the government's mindset is the same everywhere.

Razengan 6mo ago

With the first link, the chain is forged. We're into way many links already. Isn't this the country that beheaded their rulers?

fithisux 6mo ago

A public ballot should be held for this. Governments act as kings.

sMarsIntruder 6mo ago

Liberté, Égalité, Fraternité.. et Surveillance-té

alkindiffie 6mo ago

So in France you will not be able to send your friend gibberish text that only you and your friend understand. Will they also ban the ability to make new languages that only you and your friends understand. Will they also ban whispering?

tonis2 6mo ago
Yes, to protect the children ofcourse.
deleted 6mo ago
[deleted]
trolleski 6mo ago
But how can they be SURE that you are not a terrorist? Neuralink is the only option!
- baranul 6mo ago
  Unknown associations and free speech are too scary. Neuralink and continual surveillance for the win. Pre-crime units at the ready.
deleted 6mo ago
[deleted]
baranul 6mo ago
Well, if it is some gibberish between you and friends the state doesn't understand, they will have you silently and continually investigated by a pre-crime unit. You and your friends could be committing "thought-crime".
- ykonstant 6mo ago
  But I thought crime--- - He said thought crime! bots start firing the machine guns
phyzix5761 6mo ago

jemmyw 6mo ago

The article is a lot more nuanced than the title or what most folks are discussing in comments. France has politicians voting in both directions and thus far the "keep encryption and enshrine it in law" side is ahead slightly. > Senator Olivier Cadic, of the Centrist Union, secured an amendment to a separate bill on critical infrastructure resilience and cybersecurity that would do the opposite, writing encryption protection into French law and prohibiting any obligation on messaging services to install backdoors. The Senate adopted it in March 2025.

nickslaughter02 6mo ago
> His bill was examined in committee at the National Assembly in September and has been stalled since.

motbus3 6mo ago

I wonder if they remove encryption how can they ensure who are the authors. Will they still apply all the certificates?

hulitu 6mo ago
You no underestand. They will remove "encryption" but they will not remove the certificates. They learned from the CIA: Who controls certificates, controls the past.

kkfx 6mo ago

The nazi drop more and more the mask. Yet most still not wake up... BTW France already have - https://gizmodo.com/france-bill-allows-police-access-phones-camera-gps-1850609772 https://gizmodo.com/france-bill-allows-police-access-phones-... - https://www.medias-presse.info/une-nouvelle-loi-de-programmation-militaire-permettant-a-letat-de-requisitionner-tout-ce-quil-veut https://www.medias-presse.info/une-nouvelle-loi-de-programma... can't find one in English Plus - https://fr.wikipedia.org/wiki/Loi_renfor%C3%A7ant_la_s%C3%A9curit%C3%A9_int%C3%A9rieure_et_la_lutte_contre_le_terrorisme https://fr.wikipedia.org/wiki/Loi_renfor%C3%A7ant_la_s%C3%A9... - https://fr.wikipedia.org/wiki/Projet_de_loi_visant_%C3%A0_s%C3%A9curiser_et_r%C3%A9guler_l%27espace_num%C3%A9rique https://fr.wikipedia.org/wiki/Projet_de_loi_visant_%C3%A0_s%... - https://fr.wikipedia.org/wiki/Loi_tendant_%C3%A0_renforcer_la_pr%C3%A9vention_et_la_r%C3%A9pression_des_mouvements_sectaires https://fr.wikipedia.org/wiki/Loi_tendant_%C3%A0_renforcer_l... Essentially China is already here.

Canada 6mo ago

[flagged]

kmfrk 6mo ago

Chat Control refuses to die.

bgr-co 6mo ago

Hello, I am French and, with many others, fighting this. It is still a fight - no law is enacted yet - and it is not the first time we have to fight this. To state how utterly ridiculous these politicians are, ANSSI itself - the national cybersecurity agency- published a paper in 2016 clearly explaining why backdooring encryption in messaging apps is both dangerous and useless (https://www.developpez.com/actu/102152/France-l-ANSSI-se-dit-en-faveur-du-chiffrement-et-contre-l-installation-de-portes-derobees-dans-une-missive-adressee-a-plusieurs-ministeres/ https://www.developpez.com/actu/102152/France-l-ANSSI-se-dit...) This position has been clearly restated in 2025 by Guillaume Poupard, a former highly acclaimed ANSSI boss and a cryptographer.

fyltr 6mo ago

I have talked about it with a high-ranking french policeman. That person is mostly active in fighting sex-crimes on children, which is the angle I will mostly be referring to. From what I understood, it is very clear to them that even if these laws comes to pass, a good amount of criminal activities will move to other safer options. However, the general criminal is not technically competent. Currently, with WhatsApp providing end-to-end by default, access to pedophilic content is extremely simple. By suppressing these simple means of end to end encryption, the goal is to reduce the amount of people accessing these networks due to a higher entry bar. What's of course concerning is that it renders anyone using encryption suspect, which includes pedophiles and narcotrafficants, but also activists and co. Also, if we're only targetting pedophile networks, one option that comes to mind to me is the following : Most of those images are known and have been circulating for a while. By hashing any sent images and comparing them to the checksum of known ones, one could easily flag suspicions senders and proceed to access the phones of those users. Does that seem feasible to you or am I missing something?

spwa4 6mo ago
First, the French state has zero interest in access to these messages to help children. The proof: NEITHER the French police NOR the secret service investigate child abuse cases. The police only investigates them if they absolutely can't avoid it, because mostly people with access to children commit child abuse. You will find child abuse requires a child. In other words, who does that? Teachers, sports teachers and coaches and child welfare workers (sports clubs are almost exclusively government funded in France). The large majority of the perpetrators, of course, are government employees. Child services investigates child abuse cases, and WILL NOT get access to these messages. So there is zero intention to give access to messages in child abuse cases. I mean how ridiculous is this argument. They want access to such messages to investigate child abuse cases, so they demand French spies, and tax investigators get access to everyone's messages ... Child abuse investigators are not even mentioned. And it's not just that. Next, France is famous in Western Europe for being one of the only EU countries where access to, uh, hentai comics, is legal and they're sold in newspaper stands. If the French state cared about fighting sex-crimes on children they would fund taking care of the children they do "help", rather than catching criminals. Instead, this is what they do: https://www.rfi.fr/en/france/20250502-french-child-welfare-service-accused-of-allowing-kids-to-fall-into-prostitution https://www.rfi.fr/en/france/20250502-french-child-welfare-s... (at the very least they let it happen, but in practice they also hire people that will do this job at a very cheap wage because it provides access to vulnerable children) Without fixing this FIRST, the only thing catching criminals will do, obviously, is make the situation of children worse. The French state fails this test. The situation with French schools, both the immigrant situation AND the constant decline in teacher quality (for at least 3 decades now) show how much the state cares about children's future in general. Again, the state fails the test completely. And I haven't even mentioned the refugee situation in Paris. Obviously that situation is producing a flood of child prostitution. Again, the state is showing itself unwilling to help children. Again, the French state is exposed as not doing shit to help children, or at the very least, they're totally ineffective. So no, and sorry to state the obvious, but your suggestion is completely beside the point.

mmooss 6mo ago

> The “ghost participant” approach, sometimes called a ghost user proposal, was floated by GCHQ in 2018 and rejected by every major privacy organization, civil liberties group, and security researcher who looked at it. The idea is that the platform silently adds a third recipient, an invisible intelligence agent, to a supposedly two-person conversation. Users never see them. / The encryption technically still works, except that one of the parties is the state. It's an innovative idea. What defenses against this attack are in WhatsApp, Signal, etc. right now? (In any situation, attackers can attack endpoints: If they can see what the user sees, apps and encryption don't matter. They could attack remotely, or in the case of higher-interest targets, physically.) First, does the service mediate the group chat? If the messaging is peer-to-peer [0] with no server mediating, then someone would of course need to attack a peer as described above. I know Signal supposedly has no metadata, including chat participants; I don't know what mediation they do. If the service does mediate the chat somehow, then an attacker could theoretically add themselves to the group. Hiding - the 'ghost' part - from the rest of the group seems trickier, but maybe that's also possible server-side. [0] 5 users doing a mesh of multicast peer-to-peer video sounds like a utilization and quality nightmare.

harrisaydin77 6mo ago

[flagged]