33 ms·
Cross-signing and end-to-end encryption by default
- ex3ndr 6y agoHow they made scalable webrtc end-to-end encrypted? I guess it is not scalable (~5 members max).
- Arathorn 6y agoMulti-way video conferencing in Matrix isn't e2ee yet; the e2ee-by-default here refers to private group chats, DMs, and 1:1 video/voip calls. Once Jitsi lands their E2EE support (hopefully using Matrix's E2EE for key management, c.f. https://news.ycombinator.com/item?id=22855407 https://news.ycombinator.com/item?id=22855407) then we'll get E2EE video conferencing too. Until then, Matrix (but not Riot) also supports E2EE video conferencing via full mesh webrtc, but as you say, it scales to relatively few users.
- ex3ndr 6y agoInsertable streams are not going to help much since if it encrypts every frame this would mean that every frame will be encrypted and therefore couldn't be compressed. It doesn't make sense actually since you could just encrypt RTP payloads instead keeping service messages in plain text.
- Arathorn 6y agoInsertable streams let you encrypt the compressed media. WebRTC doesn’t give you hooks to re-encrypt the SRTP payloads.
- ex3ndr 6y agoHow does this visualisations are done? How it could "decode" incorrect image and display as a demo in various articles? I do not believe that video codecs are able to decode over "encrypted" data and produce some video stream.
- Arathorn 6y agothe point of insertable streams is that you can hook into the compressed payloads and encrypt them after compression, and then decrypt them before decompression. The codec never sees encrypted data.
- sm4rk0 6y agoPerfect timing: https://news.ycombinator.com/item?id=23102430 https://news.ycombinator.com/item?id=23102430 Congratulations!
- Arathorn 6y agoSee also https://news.ycombinator.com/item?id=23092269 https://news.ycombinator.com/item?id=23092269 and https://news.ycombinator.com/item?id=23088852 https://news.ycombinator.com/item?id=23088852 (these should be merged perhaps)?
- rattray 6y agoFolks who have tried Matrix/Riot and Slack – how does the product quality compare? Slack has many issues (little bugs, latency, notification issues, the shitshow markdown editor) but overall delivers a smooth product experience IME. When you self-host Matrix, do you typically get great perf without much effort? Is the product experience of the Riot client smooth and complete?
- Arathorn 6y agoHistorically, Riot's UI hasn't been as smooth as Slack's - for many years we didn't have any professional UX/UI designers contributing to the project, and we built up a lot design debt along the way. Over the last year or so we've been progressively working through fixing it, and as of Monday we now have three(!) professional designers working full time on the problem. Having turned on E2EE by default, our next big project and single biggest priority is First Time User Experience - making sure that the app is at least as smooth as Slack and Discord, particularly on first impressions. https://blog.riot.im/e2e-encryption-by-default-cross-signing-is-here/#what-s-next https://blog.riot.im/e2e-encryption-by-default-cross-signing... has more details - and the sections before it show some of the UI/UX work which has been landing in the last few months.
- godelski 6y agoI just played around with Riot for the first time. Can you directly reply to a comment in a chat room like you can in Slack (like the sub chat thing, I'm not sure what to call it)? I actually find this an extremely useful feature that allows rooms to to be uncluttered with side conversations (which as room sizes grow, this becomes a HUGE benefit). I may be missing this or I can't do it in a room of only me?
- j-james 6y agoNo, it looks like threads aren't (yet) supported in either Riot or the Matrix spec. https://github.com/matrix-org/synapse/issues/2329 https://github.com/matrix-org/synapse/issues/2329 https://github.com/vector-im/riot-web/issues/2349 https://github.com/vector-im/riot-web/issues/2349
- fack 6y agow00t! my computer club hosts a homeserver and it's been running so smoothly since we upgraded.
- im_dario 6y agoHow is memory consumption going? I'm waiting for improvement in this area or a stable release of Dendrite [0] (hoping it has a reasonable memory usage). 0: https://github.com/matrix-org/dendrite https://github.com/matrix-org/dendrite
- some_furry 6y agoYay! This is the right move for their users. There's still a ton of work left to do, but I'm thankful for all the hard work that went into making this possible.
- y7 6y agoIs there a Python SDK that supports encryption well yet? I have a simple command line script to send a message to a Matrix room. About three months ago I tried to add encryption, but apparently the old matrix-python-sdk is deprecated in favor of matrix-nio, but encryption support in the latter was very marginal still.
- Arathorn 6y agomatrix-nio's encryption is very robust now, but by far the easiest way to hook up a simple commandline script is to pipe it through pantalaimon (https://github.com/matrix-org/pantalaimon https://github.com/matrix-org/pantalaimon) - which acts as a daemon to offload E2EE from your script, using matrix-nio under the hood.
- 0x006A 6y agoyou should be able to get encryption working with nio now. nio-template is a good start https://github.com/anoadragon453/nio-template https://github.com/anoadragon453/nio-template
- godelski 6y agoOn HN I'm always seeing a fight between Signal and Matrix. Can someone explain this to me? As far as I see it: Signal replaces SMS; Matrix replaces Slack/IRC. These seem like different products that work in different spaces.
- deleted 6y ago[deleted]
- oehtXRwMkIs 6y agoI see Matrix as a sort of generalization of Signal. It's federated and decentralized, and they literally had to scale up the E2E system that Signal came up with. I use it for every form of digital communication (bridges are nice) including 1-to-1 but I think most would use it for group chats or organizations.
- Well_hello 6y agoWell, I consider this a pretty accurate description.
- hutzlibu 6y agoBut maybe people don't want to use different software for the same purpose: sending text to other people. No matter they are on a PC or smartphone. That's what botters me with Signal. Bound to a phone (number). But Signal just works and is fast (though not as fast as WhatsApp) Matrix in the default login also works, but when you choose the default open Matrix Server ... it is slow. So I also will continue to use .. not only 2 but 6 different text sending applications. But in the future I would love to just use the Matrix protocol and one software.
- godelski 6y agoI guess the difference I see is that texting I find useful for one on one conversation, or a small group. Slack I find good for big groups. I actually like to have two different apps for these because it lets me better compartmentalize my socialization, especially since the latter tends to be associated with work (I like to compartmentalize work from my social life).
- qertoip 6y agoBoth are asynchronous messengers. Signal: + protects metadata + protects the content (e2e encryption) - is not anonymous - is not resilient against regulations Matrix: - does not protect metadata + protects the content (e2e encryption) + is anonymous + is maybe, potentially resilient against regulations (federated, not centralized architecture)
- Arathorn 6y agoYou could argue that Matrix does protect metadata if you run your own server - and in extremis, one way of running your own server and protect metadata is to go P2P and embed it into your client (which is one thing we're currently working on). That said, there are some other pretty big differences between Matrix & Signal; the biggest one is probably that Matrix is an open standard and open network, encouraging 3rd party clients, servers, bridges, bots etc - optimising both for freedom/liberty as well as encryption. Signal optimises for privacy at all costs and doesn't allow 3rd party clients or services. See https://matrix.org/blog/2020/01/02/on-privacy-versus-freedom https://matrix.org/blog/2020/01/02/on-privacy-versus-freedom for more.
- tptacek 6y agoThat's not really a reasonable argument. Signal makes a profound UX tradeoff to protect metadata by not requiring servers to store it in the first place: it drafts off people's phone contact lists, and thus everyone who uses it needs to be identified by a phone number. Matrix doesn't have any special way of avoiding that tradeoff. It just takes the other end of the trade: Matrix servers are exposed to valuable metadata, so that people can use whatever identifier they want. And, of course, the flip side of Matrix's "freedom and liberty" federalized design is that it is May 7, 2020, and the project is just now announcing E2E by default for private conversations. This is exactly why, years ago, Moxie Marlinspike wrote his post arguing about the downsides of federalization. It sure looks like his predictions were borne out! I think both of these projects are valid and important, and that they have different goals and audiences, and we do people a disservice when we pretend like they're in any kind of serious competition. Matrix is what you'd replace an IRC server with. Signal is what you'd tell an immigration lawyer to use for messaging.
- gramakri 6y agoFor those looking to selfhost synapse and riot, we (cloudron.io) recently made both these packages stable. If you need help in setting them up, happy to help here (even if not on cloudron)
- snvzz 6y agoTox is: * Still alive. * Still open source libraries and most clients. * Still mandatory e2e encrypted. (unlike matrix) * Still always-on full forward secrecy. (unlike matrix) * Still full p2p. (unlike matrix) * Still works fine. Just saying. Why isn't Tox more popular? The difference has to be the amount of money/effort spent in marketing.
- atomicnumber3 6y agoIsn't tox the one from 4chan /g/? Not to deride them just for coming from 4chan, but I really seriously doubt there's been thorough 3rd party auditing of the protocol and code. IIRC signal has been audited?
- deleted 6y ago[deleted]
- zajio1am 6y agoHow it work through NATs?
- snvzz 6y agoIt implements hole punching.
- zajio1am 6y agoHole punching works for firewalls, but is unreliable for NATs. Note that most home routers are Linux based, and Linux uses symmetric NAT, where hole punching does not generally work reliably.
- snvzz 6y agoIt also implements relays, if both sides can't be reached. And it works with TCP, if it can't be made to work with UDP. And it supports ipv6. You're pretty much covered.
- est 6y agoI heard there's a telegram-like client for Matrix? Is it still around?
- john_alan 6y agoDoes this use ephemeral secrets/is it forward secret? Can see this info in the blog.
- Arathorn 6y agoIt depends on the layer. Matrix used Olm for device-to-fecice encryption, which is a clone of Signal’s double ratchet, and is PFS. For message history however we use Megolm, which is a simpler hash ratchet which is synchronised across the members of a group by sharing its state over Olm. You typically replace the Megolm ratchet every 100 msgs or 1 week, but depending on how fast you do that and how long you store the keys for, you can get PFS. The problem is that most users want to be able to access their chat history from the server, which is by definition incompatible with PFS as you have to keep the message keys around to decrypt the msgs.
- satsoul 6y agoHave you guys tried Olvid https://olvid.io/en/ https://olvid.io/en/, they removed the servers principle entirely. Worth trying
- balaa 6y agoWe've been working on a plug-and-play Matrix homeserver solution that will be entering private beta very soon. Powered by WireGuard, we tunnel federation traffic (from other homeservers) to your homeserver without requiring you to expose any ports to the world. Our solution gets you from 0-to-Matrix homeserver in about 60 seconds. This offering is part of a broader ecosystem of open-source applications that we plan to package, make push-button and provide professional support services to a non-technical audience. Our primary deployment target being custom fabricated SBCs similar to the Raspberry Pi 4. We are actively seeking developers interested in building and deploying privacy preserving, self-hosted applications (like Matrix) for this platform. Join our mailing list if you'd like an invite to our beta or to check out our developer documentation: https://www.noteworthy.im https://www.noteworthy.im