3 ms·

I'm pretty amazed at the number of chat offerings that don't offer encryption. (From a quick Google search it seems Mattermost doesn't either.) I'm still holdin

I'm pretty amazed at the number of chat offerings that don't offer encryption. (From a quick Google search it seems Mattermost doesn't either.) I'm still holding out for Matrix to deliver (I know it's currently working for some people), but my understanding is that it's not enabled by default yet: https://github.com/vector-im/riot-web/issues/6779 https://github.com/vector-im/riot-web/issues/6779

walterbell 7y ago
Work is underway at IETF on MLS for E2E encrypted group messaging, https://datatracker.ietf.org/wg/mls/about/ https://datatracker.ietf.org/wg/mls/about/
- Arathorn 7y ago
  We're looking at MLS for Matrix too. The only reason E2E isn't enabled by default on Matrix today is E2E-enabled search isn't finished yet
  - MayeulC 7y ago
    I thought you were also waiting for cross-signing (which seems to have progressed quite well) to land? Isn't E2E search mostly a client-side matter? Unless using homomorphic encryption, of course, which I don't think OLM is capable of? Or are you planning on using another trick, similar to hashing the strings client-side when a new message is received, then sending the hashs and later searching those server-side? I'm curious since I haven't seen that mentioned other than using pantalaimon as some kind of server-side search engine. I can ask or discuss this further in matrix(-spec):matrix.org as needed/preferred.
    - Arathorn 7y ago
      Cross-signing is basically there at the SDK & server level; just needs the UX to be added into Riot, but we prioritised https://matrix.org/blog/2019/06/30/tightening-up-privacy-in-matrix/ https://matrix.org/blog/2019/06/30/tightening-up-privacy-in-... so running a few weeks behind. E2E search is entire client-side, and works thanks to https://github.com/matrix-org/pantalaimon/tree/search https://github.com/matrix-org/pantalaimon/tree/search. We're not doing homomorphic stuff; instead we're thinking about encrypting the tantivy indexes and storing them serverside.
zie 7y ago
Mattermost does offer transport level encryption, via HTTPS. For most things, that's plenty good enough. But for many organizations, they want unlimited viewing of the messages anyway, so E2E would be a non-starter. It all depends on your needs. Mattermost would never be a good solution for a global chat system, nor would it be a good fit for wide-open public/untrusted access chat either, both of those are where E2E type encryption would really shine.

walterbell 7y ago

Work is underway at IETF on MLS for E2E encrypted group messaging, https://datatracker.ietf.org/wg/mls/about/ https://datatracker.ietf.org/wg/mls/about/

Arathorn 7y ago
We're looking at MLS for Matrix too. The only reason E2E isn't enabled by default on Matrix today is E2E-enabled search isn't finished yet
- MayeulC 7y ago
  I thought you were also waiting for cross-signing (which seems to have progressed quite well) to land? Isn't E2E search mostly a client-side matter? Unless using homomorphic encryption, of course, which I don't think OLM is capable of? Or are you planning on using another trick, similar to hashing the strings client-side when a new message is received, then sending the hashs and later searching those server-side? I'm curious since I haven't seen that mentioned other than using pantalaimon as some kind of server-side search engine. I can ask or discuss this further in matrix(-spec):matrix.org as needed/preferred.
  - Arathorn 7y ago
    Cross-signing is basically there at the SDK & server level; just needs the UX to be added into Riot, but we prioritised https://matrix.org/blog/2019/06/30/tightening-up-privacy-in-matrix/ https://matrix.org/blog/2019/06/30/tightening-up-privacy-in-... so running a few weeks behind. E2E search is entire client-side, and works thanks to https://github.com/matrix-org/pantalaimon/tree/search https://github.com/matrix-org/pantalaimon/tree/search. We're not doing homomorphic stuff; instead we're thinking about encrypting the tantivy indexes and storing them serverside.

zie 7y ago

Mattermost does offer transport level encryption, via HTTPS. For most things, that's plenty good enough. But for many organizations, they want unlimited viewing of the messages anyway, so E2E would be a non-starter. It all depends on your needs. Mattermost would never be a good solution for a global chat system, nor would it be a good fit for wide-open public/untrusted access chat either, both of those are where E2E type encryption would really shine.