this post was submitted on 17 Jul 2023
1182 points (96.5% liked)
Technology
69491 readers
5788 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Matrix is a security nightmare. Everyone should stay clear from it till possible solutions are found for the ongoing concerns.
What are the ongoing concerns ?
Here's a great and beginner-friendly article on the topic of secure (and private) messaging and why Matrix currently doesn't fit there: https://proton.me/blog/whatsapp-alternatives
That doesn't go into detail on the "server network reliability" and it's used by multiple government agencies around the world and they likely paid for private audits before they picked it
Which government agencies? You'd be surprised...
germanys armed forced, their health sector, france seems to use it for their entire government as well and some others Icant remember off the top of my head
Use it for public message distribution or internal comms?
internal comms I think
That link says nothing of the sort! It actually says that Matrix is a strong choice for privacy and the underlying protocol follows best practices for security.
What are these security concerns you're talking about?
Thanks !
Tbh, I don't think encryption matters that much for are usually public chat channels.
The private communication should be safe since i think the users will usually pin the keys for each other.
The problem comes from federation. You never know where your messages are synced to + what will happen if instances are defederated. Matrix might become something really cool, if it spends 1-2 years solely on security. Otherwise... it's just nothing more than an epic (and misleading) name + some IRC legacy vibes.
Rooms are stored on every server that's in the room and if a server goes offline even the one that created the room it keeps working just fine and no one notices
But you do know where your messages are synced don't you? You can check your chat partner's homeserver. Or am I mistaken?
yeah, messages are only sent to servers that are in a room, so its very easy to see and know what servers are storing the messages/metadata
And even IF a server is storing your messages — doesn't E2EE make that irrelevant? It doesn't matter if they store it as long as they cannot decrypt it. I don't quite understand @SevereLow's concerns.
yeah thats another point as well, not all rooms on matrix are encrypted, it for example makes it pointless to encrypt public rooms that anyone can join