Hacker News Reader

Comment by agilob | Hacker News Reader

>interoperability requirements for messaging services, meaning outfits such as WhatsApp, Facebook Messenger

Who will be decrypting WA and Signal message to pass them to Facebook Messanger?

Presumably if you as a user want to use an app that interoperates with Signal, Whatsapp and Messenger then you'll be logging in with your signal, whatsapp and messenger credentials and give it permission to read your messages and relay them

I don't think this is to be interpreted as "from now I need to be able to send messages from a Whatsapp client to a Signal client"

Of course any such app would be able to read all the messages in the clear and would be able to store them in the clear, leak them, sell them or whatever. As with any other case in which you choose to use a chat app you have to trust the chat app to read your messages if it wants to

I imagine if that's the case whatsapp or signal, when you do a first login from a different app, will flash a warning that you're using a third party client which might not be trustworthy

Why would they need to decrypt anything? If they use open standards such as the signal protocol, there's no need to decrypt anything.

https://signal.org/docs/

That’s fine but if the European parliament finds out that companies can comply with the legislation without making it easier for the governments to read traffic, then we can expect the legislation to change until it achieves that goal.

Even though it may not be the EU’s overtly stated main goal, it is nevertheless a goal of many aligned politicians there, and no doubt the perception among foolish politicians and bureaucrats that it will achieve that goal can account for some of their support, and if they don’t get what they want they will “fix” it until they do.

yeah, i don't think this was thought out, or at least i haven't read anything on this subject. how does the draft text deal with cryptography?

I don't think laws have to explain how to technically solve these things. e2ee could be maintained, it all depends on the level of integration/interoperation that these companies will choose. Of course, it is equally likely that they won't bother (since e2ee is under constant attack from governments anyway) and just don't go that extra mile.

Something like this can't really make end to end encryption interoperable. There will be no encryption at the transitions between systems. Clients would have to use something that can work over arbitrary textual channels like OTR or PGP.

No idea why this was downvoted. OTR is the correct answer here.

HTTPS works encrypted between multiple clients, servers and proxies without issues (mostly). There is nothing impossible about encrypted communication. It's just that all servers and clients need to work together to achieve this.

HTTPS is not end to end. End to end encryption does not require a server and could not use one anyway. Effective end to end encryption has to entirely happen on the ends.

There's no need for decryption. If you want to send things to Facebook Messenger, you can just send it to that service directly.

The topic is e2ee.

I think the topic was interoperability, i.e. being able to send messages between apps regardless of encryption considerations.

Nobody said the encrypted messages should be readable. /s

Reply on news.ycombinator.com