4 ms·

Everyone is comparing signal vs. telegram, but what about element? Far as I can tell, that might actually be secure. https://element.io/ https://element.io/

intricatedetail 6y ago
No messenger is secure. You never know if the code that is being run is the same as reviewed. If you want true privacy, then you need to encrypt messages yourself (with e.g. PGP)
- generalizations 6y ago
  Ok, fair enough. I overstated it. I'm just wondering why it's not being discussed here.
- 29083011397778 6y ago
  Wouldn't building (& hosting) the server, building the client, and communicating only with accounts using your server be just as good? Note that this isn't just theoretical - there are governments using Matrix, but not necessarily federating with other instances.
- 7v3x3n3sem9vv 6y ago
  Signal messenger uses reproducible builds. You can compare the source code to the app that's published to the app store to confirm that they're being honest. I don't know if any other competitors who do the same. As Signal messages are end-to-end encrypted, Even if their servers were compromised, your messages would still be secure. As they use a rotating key, unlike manually using PGP, even if one of the keys was intercepted, they would not be able to decrypt any of your other messages. Using PGP, if someone steals your private key, all your messages are now vulnerable. https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/
akvadrako 6y ago
To give an idea, I think Matrix (and hence Element) borrowed the e2e design from Signal. So if they did it right it should be secure. I demoed it recently as a Slack alternative and it's not very user friendly. Our groups ended up just using Signal.
- ssivark 6y ago
  I’m curious in what way you find Matrix/Element not user friendly. (Since I know people who would claim the opposite)
  - thekyle 6y ago
    I found the encryption really cumbersome. Like I just downloaded the app and its asking me to authorize my account from another Matrix client that I've previously signed into or I won't be able to read encrypted messages people send me. But I'm pretty sure I uninstalled those other clients so idk what to do there. Also I've previously had the Android app crash and throw Java stack traces, but that was an older version.
    - ffpip 6y ago
      authorize my account from another Matrix client that I've previously signed into or I won't be able to read encrypted messages people send me That's how e2ee works. You have to send all the old messages to other new client on your other device.
  - iknowstuff 6y ago
    1. Passphrases, additional to passwords, should not exist. Mainstream users don't know the difference. Matrix needs something like https://en.wikipedia.org/wiki/Secure_Remote_Password_protocol https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco.... 2. Technical lingo like "verify other session" and some buggy emoji shenanigans confuse people. The only passable device linking, based on scanning a QR code, is between Element Desktop and Element Mobile, but... 3. Element on iOS is absolutely awful. The worst interface I've ever seen. Extremely busy and convoluted. Rows of horizontally scrollable icons, duplicated as lists? Chat views where spacing is all off? It doesn't work for small group chats and doesn't work for large public chatrooms. 4. Element on iOS won't play GIFs. Element on Chrome/Electron only uploads the first frame of a pasted GIF. This was actually a deal breaker for my social circle. Frankly, just compare the user experience of Keybase and Element. Keybase got it right.
krick 6y ago
Is this Riot rebranded? Huh, it seems I'm out of the loop. Yeah, Matrix is great. I was probably among the first people to install Riot, but the grim reality is nobody (well, one geek-friend of mine and his wife) uses Matrix. Look, even I was surprised when you mentioned "Element": thought it must be some new messenger I didn't hear about... But I'd surely rather like people to promote Element here, not Signal.

intricatedetail 6y ago

No messenger is secure. You never know if the code that is being run is the same as reviewed. If you want true privacy, then you need to encrypt messages yourself (with e.g. PGP)

generalizations 6y ago
Ok, fair enough. I overstated it. I'm just wondering why it's not being discussed here.
29083011397778 6y ago
Wouldn't building (& hosting) the server, building the client, and communicating only with accounts using your server be just as good? Note that this isn't just theoretical - there are governments using Matrix, but not necessarily federating with other instances.
7v3x3n3sem9vv 6y ago
Signal messenger uses reproducible builds. You can compare the source code to the app that's published to the app store to confirm that they're being honest. I don't know if any other competitors who do the same. As Signal messages are end-to-end encrypted, Even if their servers were compromised, your messages would still be secure. As they use a rotating key, unlike manually using PGP, even if one of the keys was intercepted, they would not be able to decrypt any of your other messages. Using PGP, if someone steals your private key, all your messages are now vulnerable. https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/

akvadrako 6y ago

To give an idea, I think Matrix (and hence Element) borrowed the e2e design from Signal. So if they did it right it should be secure. I demoed it recently as a Slack alternative and it's not very user friendly. Our groups ended up just using Signal.

ssivark 6y ago
I’m curious in what way you find Matrix/Element not user friendly. (Since I know people who would claim the opposite)
- thekyle 6y ago
  I found the encryption really cumbersome. Like I just downloaded the app and its asking me to authorize my account from another Matrix client that I've previously signed into or I won't be able to read encrypted messages people send me. But I'm pretty sure I uninstalled those other clients so idk what to do there. Also I've previously had the Android app crash and throw Java stack traces, but that was an older version.
  - ffpip 6y ago
    authorize my account from another Matrix client that I've previously signed into or I won't be able to read encrypted messages people send me That's how e2ee works. You have to send all the old messages to other new client on your other device.
- iknowstuff 6y ago
  1. Passphrases, additional to passwords, should not exist. Mainstream users don't know the difference. Matrix needs something like https://en.wikipedia.org/wiki/Secure_Remote_Password_protocol https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco.... 2. Technical lingo like "verify other session" and some buggy emoji shenanigans confuse people. The only passable device linking, based on scanning a QR code, is between Element Desktop and Element Mobile, but... 3. Element on iOS is absolutely awful. The worst interface I've ever seen. Extremely busy and convoluted. Rows of horizontally scrollable icons, duplicated as lists? Chat views where spacing is all off? It doesn't work for small group chats and doesn't work for large public chatrooms. 4. Element on iOS won't play GIFs. Element on Chrome/Electron only uploads the first frame of a pasted GIF. This was actually a deal breaker for my social circle. Frankly, just compare the user experience of Keybase and Element. Keybase got it right.

krick 6y ago

Is this Riot rebranded? Huh, it seems I'm out of the loop. Yeah, Matrix is great. I was probably among the first people to install Riot, but the grim reality is nobody (well, one geek-friend of mine and his wife) uses Matrix. Look, even I was surprised when you mentioned "Element": thought it must be some new messenger I didn't hear about... But I'd surely rather like people to promote Element here, not Signal.