6 ms·

Tightening up Privacy in Matrix

101 points by blendergeek 7y ago

Havoc 7y ago
Seems like a well thought out response
WhatIsDukkha 7y ago
The addressbook, contact matching and public email are pretty low value from my perspective. I'd much rather personally validate and match my contacts on my own and I really think this should be the default with huge WARNING to people that want to share their email globally and addressbook with the server etc. "Users don't care" is largely because developers submarine the issues with "UX flow" reasoning. Excusing this toxic data exfiltration with "UX" really doesn't hold water. Edit - Specifically looking at https://github.com/vector-im/riot-web/issues/10167 https://github.com/vector-im/riot-web/issues/10167 This looks like industry standard bury the issue in unreadable TOS boilerplate. How about "Hey YOU PROBABLY DON'T NEED to share your email globally unless you expect to meet your long lost cousin via the matrix.org social graph" This is a place where ADDING friction makes the world better.
- Arathorn 7y ago
  (Matrix lead here) The core problem is: empirically most users want an app which works like Signal, WhatsApp, Telegram etc and tells you which other users are contactable. If you’re some random installing a comms app, you want to know if any of your contacts are on it already. It’s nothing to do with whether your long lost cousin is on it. However, there are then folks hyperfocused on privacy who declare this ‘toxic data exfiltration’ and vociferously object. We’re trying to get the balance right, and it’s worth noting that the bug you linked is still up in the air. We don’t have the final UX yet, but the idea is to even more explicitly warn the user that their contacts are being uploaded to a identity lookup service if they want to discover people on the network. An alternative/complementary approach is https://github.com/vector-im/riot-web/issues/10093 https://github.com/vector-im/riot-web/issues/10093. (edited due to accidentally hitting submit...)
  - DyslexicAtheist 7y ago
    I really want to cheer for matrix/riot and this blog post moves me in that direction, but then seeing your comment as lead-dev throws me back into reality. The post is all about _tightening_ privacy! So why is the suggestion to solve addressbook feature more elegantly than a a TOS not addressed and instead GP is dismissed as being hyperfocused on privacy. The reason I cheer about Matrix is exactly because of its P2P nature, which neither of the other privacy focused solutions like Wire/Signal address (though these give better privacy right now). Isn't it exactly the privacy conscious crowd that matrix is pitching to? Those of us who don't trust a signal or wire server because that server code is proprietary? Matrix has been promising better privacy (and e2e encryption) for some time but maybe this isn't actually where matrix is heading? I sure would like to know because there is no point for many of us to continue cheering for what otherwise looks really promising. And it's not like a better technical solution for the address book doesn't exist!!
    - _Codemonkeyism 7y ago
      Like everyone else they want to become the next WhatsApp - with only "the privacy conscious crowd" they don't think they'll get there. They market to your mom.
      - Arathorn 7y ago
        We really don't want to become the next WhatsApp fwiw. The idea is more to be the new email, or the realtime version of the web. We should be able to support the use cases both for privacy enthusiasts as well as mums, dads, grandparents or whoever.
        etiam 7y ago
        Do you imagine the new email is going to be anything like the old email, in allowing easy composition of substantial, letter-length messages which can be organized in their own right? I would love to be able to point non-technical users to an email alternative with sane integrity properties, and I've tried to some extent to push correspondence to Riot, but as it is right now, many of those users seem to suffer from Riot's flat design and not adapting well to the room metaphor. And one trigger-happy composition line posted to infinity scroll chat is pretty far from the experience of even a rudmentary email client. I'll admit I haven't done a thorough search of the clients but if you're aware of good implementations of a letter metaphor for Matrix I'd be very grateful to learn what I've been missing.
meruru 7y ago
I'll take the chance to plug miniVector again. It doesn't solve the problems discussed in this thread, but it's a stripped-down Riot fork that requires fewer permissions than the full program: https://github.com/LiMium/mini-vector-android https://github.com/LiMium/mini-vector-android I have no affiliation with the project.
- larkeith 7y ago
  Also RiotX (full rewrite of Riot Android) is hopefully landing soon, so that should improve the mobile experience a lot for people who want a full client.
maxidorius 7y ago
(One of the author of the research doc that triggered this blog entry here) It's good to finally see a reply, and it's good to see you are addressing some of the issues we have highlighted. It's a shame it took a whole research document posted on Hacker News and other websites to start getting your attention. I am personally surprised about this blog entry (and reply to some extend), given that the research doc was labeled as "FUD" by the lead dev. Now that we have it, and that you answered in a blog post, there is one question we asked several times and that you still did not answer, even in our GDPR data request: Given that the research document clearly highlights that users are totally unaware of how their personal data was collected, how its going to be used, and that they did not given consent (e.g. storing their email addresses for a lookup query mechanism) under EU GDPR: 1. Under which lawful basis do you collect, process and allow others to use such data? 2. Are you going to keep storing/using all the data you have collected using all the methods highlighted in the research doc, or will you purge all that was collected without clear knowledge and consent of the users?
- deleted 7y ago
  [deleted]
0xNippon 7y ago
I host my own Synapse instance and for the most part it's very reliable. I don't bridge to anything. So far it's been like pulling teeth to get my friends to sign up but once they do it's been super reliable. I'm traveling through Japan right now and the server hosted in NYC has been fine. There are a few problems. First the UI for approving new client connections in encrypted chat rooms is complete crap. It needs to be clear and concise what is happening and currently it starts a super complicated verification process which is frankly confusing. It simply needs to say "$user has signed in on a new device $deviceName. Is it okay to send messages to this device? Yes/No" That's it. Also there needs to be a better way to integrate third party plugins. One thing I miss from Facebook messenger is being able to paste a Spotify link and have the song come up as an embed. Finally the bot API could use work. I spent some time professionally maintaining a Slack bot for a major American cable company and currently it's much harder to make a Matrix bot and documentation is lacking.
- cyphar 7y ago
  > There are a few problems. First the UI for approving new client connections in encrypted chat rooms is complete crap. It needs to be clear and concise what is happening and currently it starts a super complicated verification process which is frankly confusing. Device cross-signing has nearly landed and will solve this problem by creating a pseudo-WoT between users meaning that you need to do verifications very infrequently (ideally, only once when you first start talking to the user). > It simply needs to say "$user has signed in on a new device $deviceName. Is it okay to send messages to this device? Yes/No" Doing it this way would open the door to a malicious homesever (or a user's account being hacked into) being able to eavesdrop on you. Device names aren't cryptographically relevant. Device cross-signing (where a user's devices sign each other) solves the problem in a much safer way. > Finally the bot API could use work. I spent some time professionally maintaining a Slack bot for a major American cable company and currently it's much harder to make a Matrix bot and documentation is lacking. This boils down to the fact that bots are basically just normal Matrix clients (with a few extra features if you've set them up as an application service). You might be better served by using a library (like matrix-nio or the Matrix SDKs).
rendx 7y ago
The feature I miss most is expiring messages. Yes, it totally depends on correct end-user client implementations and honest participants, but it is crucial for many scenarios where a client is compromised after the fact (or, lets say, an over-ambitious border control...). https://github.com/vector-im/riot-web/issues/2497 https://github.com/vector-im/riot-web/issues/2497
- Arathorn 7y ago
  Hopefully this will be coming relatively soon once https://github.com/matrix-org/matrix-doc/pull/1763 https://github.com/matrix-org/matrix-doc/pull/1763 is implemented. It’s mainly been waiting for someone interested in sponsoring the feature (which hasn’t happened yet).
maxidorius 7y ago
Interesting that you tighten up privacy by adding more tracking to your main website with a cooking spanning sub-domains as well: https://github.com/matrix-org/matrix.org/commit/48545495afe19a40152a166baee521bca1562d07 https://github.com/matrix-org/matrix.org/commit/48545495afe1... and JS code from twitter directly: https://github.com/matrix-org/matrix.org/commit/30ece47f893075869ddba7a7906bcac79f1ca50a https://github.com/matrix-org/matrix.org/commit/30ece47f8930...

101 points by blendergeek 7y ago

Seems like a well thought out response

The addressbook, contact matching and public email are pretty low value from my perspective. I'd much rather personally validate and match my contacts on my own and I really think this should be the default with huge WARNING to people that want to share their email globally and addressbook with the server etc. "Users don't care" is largely because developers submarine the issues with "UX flow" reasoning. Excusing this toxic data exfiltration with "UX" really doesn't hold water. Edit - Specifically looking at https://github.com/vector-im/riot-web/issues/10167 https://github.com/vector-im/riot-web/issues/10167 This looks like industry standard bury the issue in unreadable TOS boilerplate. How about "Hey YOU PROBABLY DON'T NEED to share your email globally unless you expect to meet your long lost cousin via the matrix.org social graph" This is a place where ADDING friction makes the world better.

Arathorn 7y ago
(Matrix lead here) The core problem is: empirically most users want an app which works like Signal, WhatsApp, Telegram etc and tells you which other users are contactable. If you’re some random installing a comms app, you want to know if any of your contacts are on it already. It’s nothing to do with whether your long lost cousin is on it. However, there are then folks hyperfocused on privacy who declare this ‘toxic data exfiltration’ and vociferously object. We’re trying to get the balance right, and it’s worth noting that the bug you linked is still up in the air. We don’t have the final UX yet, but the idea is to even more explicitly warn the user that their contacts are being uploaded to a identity lookup service if they want to discover people on the network. An alternative/complementary approach is https://github.com/vector-im/riot-web/issues/10093 https://github.com/vector-im/riot-web/issues/10093. (edited due to accidentally hitting submit...)
- DyslexicAtheist 7y ago
  I really want to cheer for matrix/riot and this blog post moves me in that direction, but then seeing your comment as lead-dev throws me back into reality. The post is all about _tightening_ privacy! So why is the suggestion to solve addressbook feature more elegantly than a a TOS not addressed and instead GP is dismissed as being hyperfocused on privacy. The reason I cheer about Matrix is exactly because of its P2P nature, which neither of the other privacy focused solutions like Wire/Signal address (though these give better privacy right now). Isn't it exactly the privacy conscious crowd that matrix is pitching to? Those of us who don't trust a signal or wire server because that server code is proprietary? Matrix has been promising better privacy (and e2e encryption) for some time but maybe this isn't actually where matrix is heading? I sure would like to know because there is no point for many of us to continue cheering for what otherwise looks really promising. And it's not like a better technical solution for the address book doesn't exist!!
  - _Codemonkeyism 7y ago
    Like everyone else they want to become the next WhatsApp - with only "the privacy conscious crowd" they don't think they'll get there. They market to your mom.
    - Arathorn 7y ago
      We really don't want to become the next WhatsApp fwiw. The idea is more to be the new email, or the realtime version of the web. We should be able to support the use cases both for privacy enthusiasts as well as mums, dads, grandparents or whoever.
      - etiam 7y ago
        Do you imagine the new email is going to be anything like the old email, in allowing easy composition of substantial, letter-length messages which can be organized in their own right? I would love to be able to point non-technical users to an email alternative with sane integrity properties, and I've tried to some extent to push correspondence to Riot, but as it is right now, many of those users seem to suffer from Riot's flat design and not adapting well to the room metaphor. And one trigger-happy composition line posted to infinity scroll chat is pretty far from the experience of even a rudmentary email client. I'll admit I haven't done a thorough search of the clients but if you're aware of good implementations of a letter metaphor for Matrix I'd be very grateful to learn what I've been missing.

meruru 7y ago

I'll take the chance to plug miniVector again. It doesn't solve the problems discussed in this thread, but it's a stripped-down Riot fork that requires fewer permissions than the full program: https://github.com/LiMium/mini-vector-android https://github.com/LiMium/mini-vector-android I have no affiliation with the project.

larkeith 7y ago
Also RiotX (full rewrite of Riot Android) is hopefully landing soon, so that should improve the mobile experience a lot for people who want a full client.

maxidorius 7y ago

(One of the author of the research doc that triggered this blog entry here) It's good to finally see a reply, and it's good to see you are addressing some of the issues we have highlighted. It's a shame it took a whole research document posted on Hacker News and other websites to start getting your attention. I am personally surprised about this blog entry (and reply to some extend), given that the research doc was labeled as "FUD" by the lead dev. Now that we have it, and that you answered in a blog post, there is one question we asked several times and that you still did not answer, even in our GDPR data request: Given that the research document clearly highlights that users are totally unaware of how their personal data was collected, how its going to be used, and that they did not given consent (e.g. storing their email addresses for a lookup query mechanism) under EU GDPR: 1. Under which lawful basis do you collect, process and allow others to use such data? 2. Are you going to keep storing/using all the data you have collected using all the methods highlighted in the research doc, or will you purge all that was collected without clear knowledge and consent of the users?

deleted 7y ago
[deleted]

0xNippon 7y ago

I host my own Synapse instance and for the most part it's very reliable. I don't bridge to anything. So far it's been like pulling teeth to get my friends to sign up but once they do it's been super reliable. I'm traveling through Japan right now and the server hosted in NYC has been fine. There are a few problems. First the UI for approving new client connections in encrypted chat rooms is complete crap. It needs to be clear and concise what is happening and currently it starts a super complicated verification process which is frankly confusing. It simply needs to say "$user has signed in on a new device $deviceName. Is it okay to send messages to this device? Yes/No" That's it. Also there needs to be a better way to integrate third party plugins. One thing I miss from Facebook messenger is being able to paste a Spotify link and have the song come up as an embed. Finally the bot API could use work. I spent some time professionally maintaining a Slack bot for a major American cable company and currently it's much harder to make a Matrix bot and documentation is lacking.

cyphar 7y ago
> There are a few problems. First the UI for approving new client connections in encrypted chat rooms is complete crap. It needs to be clear and concise what is happening and currently it starts a super complicated verification process which is frankly confusing. Device cross-signing has nearly landed and will solve this problem by creating a pseudo-WoT between users meaning that you need to do verifications very infrequently (ideally, only once when you first start talking to the user). > It simply needs to say "$user has signed in on a new device $deviceName. Is it okay to send messages to this device? Yes/No" Doing it this way would open the door to a malicious homesever (or a user's account being hacked into) being able to eavesdrop on you. Device names aren't cryptographically relevant. Device cross-signing (where a user's devices sign each other) solves the problem in a much safer way. > Finally the bot API could use work. I spent some time professionally maintaining a Slack bot for a major American cable company and currently it's much harder to make a Matrix bot and documentation is lacking. This boils down to the fact that bots are basically just normal Matrix clients (with a few extra features if you've set them up as an application service). You might be better served by using a library (like matrix-nio or the Matrix SDKs).

rendx 7y ago

The feature I miss most is expiring messages. Yes, it totally depends on correct end-user client implementations and honest participants, but it is crucial for many scenarios where a client is compromised after the fact (or, lets say, an over-ambitious border control...). https://github.com/vector-im/riot-web/issues/2497 https://github.com/vector-im/riot-web/issues/2497

Arathorn 7y ago
Hopefully this will be coming relatively soon once https://github.com/matrix-org/matrix-doc/pull/1763 https://github.com/matrix-org/matrix-doc/pull/1763 is implemented. It’s mainly been waiting for someone interested in sponsoring the feature (which hasn’t happened yet).

maxidorius 7y ago

Interesting that you tighten up privacy by adding more tracking to your main website with a cooking spanning sub-domains as well: https://github.com/matrix-org/matrix.org/commit/48545495afe19a40152a166baee521bca1562d07 https://github.com/matrix-org/matrix.org/commit/48545495afe1... and JS code from twitter directly: https://github.com/matrix-org/matrix.org/commit/30ece47f893075869ddba7a7906bcac79f1ca50a https://github.com/matrix-org/matrix.org/commit/30ece47f8930...