4 ms·

So Pantalaimon is something that needs to be added and configured, how easy is it to fuck up this configuration and accidentally send a non-E2EE message? Is it

by maqp 6y ago

So Pantalaimon is something that needs to be added and configured, how easy is it to fuck up this configuration and accidentally send a non-E2EE message? Is it a program you can forget to launch? Is it something that can crash and make the user vulnerable? How many of the apps you listed in second paragraph spawn E2EE chat by default? How many of the apps warn about E2EE not being enabled when joining a room? How many of the apps warn when E2EE is broken by e.g. IRC-bridge-bots?

Arathorn 6y ago
Pan won’t let you send plaintext msgs in E2EE rooms. If you don’t launch it, your client can’t connect. It doesn’t have any known downgrade vulns. You can’t downgrade an E2E room to a non-encrypted one. I haven’t checked to see which of those apps spawns E2EE chat by default. Element does, and I’d assume the other client devs are following suit; there’s no reason not to. Likewise, i haven’t surveyed to see what UI they use to warn for unencrypted rooms. We’re currently working on an MSC to better advertise what bots/bridges exist in a room so you can track whether any is likely to be leaking your conversation to an unencrypted system. This is inevitably going to be on a best effort basis though.
- dependenttypes 6y ago
  > Element does But does not warn regarding unverified seasons and will gladly send messages to them by default.