this post was submitted on 24 Jul 2023
127 points (97.0% liked)

Privacy

32156 readers
916 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
127
How does using Matrix compare with using Signal, privacy-wise? (self.privacy)
submitted 1 year ago* (last edited 1 year ago) by Kalcifer to c/[email protected]
59 comments fedilink hide all child comments
 

I'm not sure if it is entirely accurate to compare them in this way, as "Matrix" refers to simply the protocol, whereas "Signal" could refer to the applications, server, and protocol. That being said, is there any fundamental difference in how the Matrix ecosystem of federated servers, and independently developed applications compares to that of Signal that would make it less secure, overall, to use?

The most obvious security vulnerability that I can think of is that the person you are communicating with (or, conceivably, oneself, as well) is using an insecure/compromised application that may be leaking information. I would assume that the underlying encryption of the data is rather trustworthy, and the added censorship resistance of federating the servers is a big plus. However, I do wonder if there are any issues with extra metadata generation, or usage tracking that could be seen as an opsec vulnerability for an individual. Signal, somewhat famously, when subpoenaed to hand over data, can only hand over the date that the account was created, and the last time it was used. What would happen if the authorities go after a Matrix user? What information about that user would they be able to gather?

you are viewing a single comment's thread
view the rest of the comments
[–] zephyr 0 points 1 year ago (3 children)

https://securemessagingapps.com

[–] Kalcifer 16 points 1 year ago* (last edited 1 year ago) (1 children)

Hm, I have trouble trusting any information on that site for a number of reasons:

  1. They don't seem to grasp the concept of a federated service, and how that plays a role with "Matrix". As stated on this page, under "Riot/Element":
  • There have been no code audit and an independent security analysis, and hence we must take Element’s word. No one can mark his own homework.
  • Matrix has had at least one embarrassing security breach, indicating that their infrastructure security is lacking.

They seem to be referring to "Matrix", and "Element" interchangeably which doesn't make any logical sense as "Matrix" describes the underlying federation protocol, and "Element" one of many clients that exist. This line of thinking can also be seen in the comparison table; the column title is "Element/Riot", and yet much of the data contained in the table is referring to things related to the protocol.

  1. Furthermore, it should also be noted that the quote in point #1 is complete misinformation, and blatantly false (it should also be noted that this information is repeated elswhere, including the comparison table). Firstly,

There have been no code audit and an independent security analysis, and hence we must take Element’s word. No one can mark his own homework.

Ignoring that they say "Element", and, instead, assuming that they intended to say "Matrix", from what I can see, there are at least two independent audits that have been done -- their respective information can be found on the blog posts here, and here. and secondly,

Matrix has had at least one embarrassing security breach, indicating that their infrastructure security is lacking.

Ignoring the fact that this statement makes no logical sense since "Matrix" is a protocol, and therefore the idea of a "security" breach does not even apply, I'm going to instead assume that they are referring to the home-server "matrix.org". The security breach I'm assuming that they are referring to is described in the blog post here:

TL;DR: An attacker gained access to the servers hosting Matrix.org. The intruder had access to the production databases, potentially giving them access to unencrypted message data, password hashes and access tokens.

I'm not entirely sure what the author was insinuating, since this is just something that affected the matrix.org homeserver and no one else, and has absolutely nothing to do with the security of the protocol on the whole. The only important thing with this is whether or not the retrived unencrypted data (ignoring the messages) has any affect of compromising the security of the user -- this author, unfortunately, makes no effort to explore this idea, and just moves on.

There are plenty of other discontinuties that can be picked apart from this person's site, but these were the most immediately glaring.

[–] fkn 0 points 1 year ago (1 children)

It's wrong to say matrix is only the protocol.

Matrix.org is the server that element defaults to and the vast majority of people use.

It is true that element hasn't had a security audit, but the matrix.org servers have.

The protocol is separate from the server.

[–] Kalcifer 2 points 1 year ago* (last edited 1 year ago) (1 children)

It’s wrong to say matrix is only the protocol.

Matrix is only the protocol. Synapse is the name of the server software. "matrix.org" is just the URL of the main homeserver.

From Matrix's About section:

Matrix is an open protocol for decentralised, secure communications.

Here, you can find Synapse.

[–] fkn -1 points 1 year ago (1 children)

This is a poor take and ignores the proper level of abstraction when discussing the situation.

[–] Kalcifer 1 points 1 year ago (1 children)

Would you mind elaborating?

[–] fkn -1 points 1 year ago

In context, disambiguating "matrix" the protocol, "matrix.org" the server and "element" the application obviously implies that "matrix.org" is not being referred to as the domain name.

"Matrix.org" in this case should be abstracted to mean the service as a whole providing the matrix.org website, matrix protocol endpoints, hosting solutions, business and other accoutrements.

The original question was in relation to signal vs matrix. "Signal" in this context refers to more than just the dns entry, business, protocol, frontend application or other elements. It should be obvious that referring to "Signal" implies all of these elements. Which is where my reply comes into effect.

You made the mistake of mistaking the organization (and all related services) of "element" and "matrix.org" and the matrix protocol. These are not the same thing. In the context of using the name of the thing to refer to the organization, servers and other errata; "Element" refers to a single independent organization and application that provides a single implementation of a client side portion of the matrix protocol. "Matrix.org" is a separate, independent organization that is providing a server implementation of the matrix protocol.

Your guess that "matrix" and "element" are interchangeable in the original article is incorrect. "Matrix.org" is a separate organization from "element".

From this point of view, coming back with the statement "matrix.org is a domain name" is frankly insulting.

[–] [email protected] 10 points 1 year ago

That chart is full of outdated information and outright falsehoods. What a mountain of misleading bias.

[–] Nioxic 7 points 1 year ago (1 children)

Matrix isnt mentioned on that site?

[–] qaz 5 points 1 year ago

Element is a matrix client