3 ms·

If you really want encryption with only access by the people in the room, you can use Matrix: it's not based on your password, but on the keys. If you have your

If you really want encryption with only access by the people in the room, you can use Matrix: it's not based on your password, but on the keys. If you have your keys (and encryption has been enable in the room), you and only you/your devices can read the messages.

giancarlostoro 8y ago
So if someone else changes the password it doesnt show them? What if you legitimately chang your own password how does that work? I think I like the proof concept from Keybase unfortunately their name makes it sound like an SSH key repo and not an all in one chat and file sharing service. Also not quite as open as Matrix in the sense that people can choose other servers.
- miloignis 8y ago
  Right, the encryption isn't based on the password, but on encryption keys that are only on your devices. If you want to add a new device, you share the keys from one of your other devices to that new device. But just being able to log into an account (say by having the password) on a new device doesn't give any way to get the keys/read the encrypted messages.
  - giancarlostoro 8y ago
    So how easy is it to transfer between devices? This sounds like your keys could wind up in untrusted sources like if e.g. someone emails their keys to themselves, pretty sure then all bets are off that those keys are even secure?
    - miloignis 8y ago
      Quite! If you don't have them backed up to your homeserver Riot asks you if you want to share the keys with the new device, you check that the device ID and key match, and then hit ok and it happens. If you have them backed up to your homeserver, you just hit download from server then put in the password you encrypted them with.
- sharedfrog 8y ago
  Correct, it won't show if you change your password. For legitimate uses, you export your session keys prior to changing your password. In Riot (the most prominent Matrix client), you need to log out to change your password. In the current version, you're warned to export your keys if you want to maintain the logs from any encrypted conversations.

giancarlostoro 8y ago

So if someone else changes the password it doesnt show them? What if you legitimately chang your own password how does that work? I think I like the proof concept from Keybase unfortunately their name makes it sound like an SSH key repo and not an all in one chat and file sharing service. Also not quite as open as Matrix in the sense that people can choose other servers.

miloignis 8y ago
Right, the encryption isn't based on the password, but on encryption keys that are only on your devices. If you want to add a new device, you share the keys from one of your other devices to that new device. But just being able to log into an account (say by having the password) on a new device doesn't give any way to get the keys/read the encrypted messages.
- giancarlostoro 8y ago
  So how easy is it to transfer between devices? This sounds like your keys could wind up in untrusted sources like if e.g. someone emails their keys to themselves, pretty sure then all bets are off that those keys are even secure?
  - miloignis 8y ago
    Quite! If you don't have them backed up to your homeserver Riot asks you if you want to share the keys with the new device, you check that the device ID and key match, and then hit ok and it happens. If you have them backed up to your homeserver, you just hit download from server then put in the password you encrypted them with.
sharedfrog 8y ago
Correct, it won't show if you change your password. For legitimate uses, you export your session keys prior to changing your password. In Riot (the most prominent Matrix client), you need to log out to change your password. In the current version, you're warned to export your keys if you want to maintain the logs from any encrypted conversations.