News for hackers. Stuff that matters.
Re:Germany's national healthcare system adopts Matrix for co... by corty on Wednesday July 21, 2021 @10:36AM (#27906858)
Well, they could still have opted for something proprietary, weird and broken. See for example the De-Mail desaster[0] and the beA desaster[1]. Both supposedly better and secure email/messenger replacements with huge problems like lacking end-to-end encryption, design problems, laughably lacking security, high cost, low adoption (except were required by law), no usability, etc.

I'm really glad that at least someone here might have learned from those mistakes.

[0] https://de.wikipedia.org/wiki/De-Mail https://netzpolitik.org/2015/de-mail-das-tote-pferd-wird-wei...

[1] https://de.wikipedia.org/wiki/Besonderes_elektronisches_Anwa...

Re:Germany's national healthcare system adopts Matrix for co... by GoblinSlayer on Wednesday July 21, 2021 @11:12AM (#27907396)
Didn't they force a backdoor on tutanota e2ee? Why do they suddenly allow matrix?
Re:Germany's national healthcare system adopts Matrix for co... by corty on Wednesday July 21, 2021 @11:23AM (#27907540)
E2EE isn't forbidden per se. But if you are a public communication provider over a certain size you need to provide access upon request if technically possible. It isn't really clear even in the case of Tutanota if they fall into that regulation, however, they had to preliminarily comply anyways: https://www.heise.de/news/Gericht-zwingt-Mailprovider-Tutano...

Healthcare providers operating a Matrix server won't be communication providers to the public, and if they aren't using a web client or some similar crap, breaking E2EE won't be possible. Webmail providers claiming E2EE like Tutanota are imho liars anyways, because Javascript on a website isn't a secure "end" for the encryption.

So use client software that isn't attacker controlled easily, keep your keys private, only encrypt to trustworthy keys and you'll be fine. Matrix ticks all those boxes if you don't use the web client. And the only legal way in for German law enforcement would be to infect your device with some trojan ("Bundestrojaner", like e.g. NSO Pegasus).

Re:Germany's national healthcare system adopts Matrix for co... by germanier on Wednesday July 21, 2021 @11:24AM (#27907549)
German government IT is far removed from being a monolithic entity. There are a lot of different actors involved with different priorities.

In this case law enforcement can simply request the data (as long as such a request is legal) at either end. No need to attack the connection in between.