Technology

I wish they did the Mullvad thing and let you sign up with nothing at all.

It‘s her approach to frame the technology instead of acknowledging that she is the victim of a social engineering attack.

Thank you. I do wish the public conversation were more about actual tech vs social engineering and public-vibe opinion.

I like the fact that Wire uses a separate key for every device and every 2-person pair, even in a group chat.

But I hate how much metadata that Wire leaks. I do not want my ISP/VPN provider to be able to track where I am and with whom I am messaging. IP addresses, routing paths, packet sizes, timing...

Both protocols encrypt what you say. Wire betrays where you were when you said it and gives a lot more clues about who you said it to. Exactly what you want people to use, if you are a nation-state able to monitor corporate ISPs and VPNs.

This is due to phishing attacks and account takeover attempts, not due to the platform itself being insecure.

I mean, it's not that Signal has security issues per se, but it doesn't have the German government's security people with control over what goes into releases, either.

If you remember the wake of Signalgate, the US doesn't allow use by American officials of Signal to do their communications because they don't certify it for classified information transmission and do have their own app that officials are supposed to be using.

On March 15, Secretary of Defense Pete Hegseth used the chat to share sensitive and classified details of the impending airstrikes, including types of aircraft and missiles, as well as launch and attack times.[1][2] The name of an active undercover CIA officer was mentioned by CIA director John Ratcliffe in the chat,[3] while Vance and Hegseth expressed contempt for European allies.[4][5]

A forensic investigation by the White House information technology office determined that Waltz had inadvertently saved Goldberg's phone number under Hughes' contact information. Waltz then added Goldberg to the chat while trying to add Hughes.[15] Subsequently, investigative journalists reported Waltz's team regularly created group chats to coordinate official work[16] and that Hegseth shared details about missile strikes in Yemen to a second group chat which included his wife, his brother, and his lawyer.[17]

On March 18, 2025, the Pentagon sent a department-wide memo warning, "Please note: third party messaging apps (e.g. Signal) are permitted by policy for unclassified accountability/recall exercises but are NOT approved to process or store nonpublic unclassified information"—a category whose release would be far less potentially damaging than that about ongoing military operations.[27] A former NSA hacker said that linking Signal to a desktop app is one of its biggest risks, as Ratcliffe suggested he had done.[28]

According to the article, German government information security people do that for Wire:

Klöckner highlighted that Wire is already provided by the Bundestag administration and is certified by Germany’s Federal Office for Information Security (BSI).

Feels to me like it’s just a different attack vector.

feels like typical security through obscurity

It was mostly German conservative figures falling for the phishing attack, and it's mostly German conservatives demanding this right now. So they're responding in a characteristically conservative fashion: zero self-awareness, zero competence in the matter, but righteousness cranked all the way up to eleven.

A lot of journalists got that wrong in initial reporting. But as an IT administrator you can see where they are coming from with their switch to another platform.

Signal is end user software, and a very good one at that. But it is no enterprise grade software. It lacks the management and policies needed for such user groups, which Wire seems to provide. Things like a mobile number as primary account handle spells ease and low entrance hurdle for end users, and a security problem for administrations.

The fractured nature of the IT in German politics is probably still keeping the attack surface alive. As outlined here by heise:

https://www.heise.de/en/background/Signal-attacks-Political-reality-bites-the-IT-admin-11279251.html

They have no clue what is safe or dangerous or reasonable or stupid. For a few decades now, the Internet has been "Neuland" to them, that is, unexplored country. These geriatric chucklefucks couldn't be arsed to seriously and systematically explore it if you held a gun to their head.

(I don't advocate holding guns to their head, for the record. It wouldn't solve the systematic issue underpinning their incompetence. It would also give them advance warning.)

... or they could just use Molly if they want to sign up with just their email and not a phone number but otherwise still use all the same privacy tech

You can also run a Matrix site federated but fully private and get similar security with more features.

Yes, it's a dumb idea. I imagine the idea is that you can tell if an email is from a government domain or not.

Or have someone advising them, who happens to have a vested financial interest.

Doesn't have to be nefarious. Happens all the time.

They did not "choose" it as an official tool for internal communication. It was her private phone with a by her installed Signal. Besides that: Phishing can happen on any platform, especially one that is available to the public. Signal is not issue here and swapping email registration against verification by mobile phone number won't solve anything.