- Thierry Spanjaard
No WhatsApp, no Telegram, no Signal!
The removal of well-known and widely spread instant messaging services is what is happening to French ministers and high-ranking civil servants this week. A circular signed by Elisabeth Borne, the French Prime Minster, requires all government employees to uninstall foreign communication apps such as WhatsApp, Telegram and Signal by December 8, 2023, in favor of Olvid, a messaging app developed in France and benefitting from public support.
Olvid, as a corporation has been created in 2019 by cryptography experts Thomas Baignères from EPFL (Swiss Federal Institute of Technology in Lausanne) and Matthieu Finiasz from ENS, Polytechnique and Inria. They set up as their goal to provide a safer and more respectful of privacy alternative to existing instant messengers. Olvid principle is that messages transit on servers but are not stored on them; these servers are simply drop boxes: messages are deleted after they are received by their recipients. Olvid includes no directory of users, thus their identity is not transmitted. Not only messages but also metadata are encrypted. And durable keys are reserved for authentication, messages are encrypted with single-use session keys. The fact that Olvid is not storing much data on servers makes it also more resistant to cyber attacks.
Olvid supports phone calls, but not yet video calls. While the free version is limited to one terminal, the premium one allows to receive and send messages on several platforms.
French authorities call Olvid the safest messaging app in the world; It is already used by the Ministry for Digital Transition and Telecommunications and the RAID (Research, Assistance, Intervention, Deterrence) an elite unit of the police. The app has received two CSPN (first level security certification) certifications from ANSSI (French National Agency for the Security of Information Systems).
As often security improvement is at the cost of user-friendliness: establishing a new contact on Olvid requires an authentication of the person's identity, either with a physical contact, or, at least, with a secure exchange of a QR-code on another platform.
Numerous benchmarks have been published ranking global worldwide messaging apps based on the way they threaten our privacy. Unsurprisingly, Facebook Messenger collects the most data, then comes WhatsApp (also Meta Group), Telegram and the most virtuous is Signal.
Quarkslab, a Paris-based team of cyber-security engineers and developers, ranks more services including Olvid, on security parameters.
It is interesting to remember that, in 2020, the European Commission recommended the use of Signal for all its communications. One may wonder how French civil servants will efficiently communicate with their European counterparts if they use two different platforms.
Founders of Olvid have been close to French sovereignty watchdogs since the inception of the company: they come from highly praised universities and labs, they established a fruitful relation with many institutions: ANSSI, INRIA (National Institute for Research in Digital Science and Technology), GICAT (Group of French Industries for Land and Air-land Defense and Security), ACN (Alliance for Digital Trust) and IHEDN (Institute of Advanced Studies in National Defense), … Some analysts consider the latest government decision to be the reward for intense lobbying actions.
The government decision to impose Olvid, and all the press coverage it has obtained, undoubtedly constitutes a considerable boost for the company.
