5 ms·

Not only Matrix leaks metadata all over the place, but it relies on the idea of encryption being safe FOREVER. In 30 or 40 years all your messages might be pub

Not only Matrix leaks metadata all over the place, but it relies on the idea of encryption being safe FOREVER. In 30 or 40 years all your messages might be public.

hellcow 5y ago
They use perfect forward secrecy through OLM, no?
- blendergeek 5y ago
  "Perfect Forward Secrecy", better termed "Forward Secrecy", allows old messages to remain secret even if the long-term secrets are leaked. If current cryptographic primitives are fundamentally broken, all data can be decrypted if it is saved. This is why it is safest to destroy everything if you are worried about threats in the distant future.
  - hellcow 5y ago
    Got it. So the concern is that there's no support for time-based deletion of messages? That is on their public roadmap, and I think it's reasonable to assume that'll be deployed before modern ECC is broken. Or am I misunderstanding the concern?
    - goodpoint 5y ago
      You cannot delete encrypted data once it has been shared with the whole world.
      - kitkat_new 5y ago
        messages don't get shared with the whole world, but only the users and the homeservers the users choose
    - blendergeek 5y ago
      The main concern is that the encrypted data is stored on the server long-term. The longer it is on the server, the more likely it becomes that it is saved by an adversary. If data is only stored for a minimal amount of time, we lower the risk of an adversary acquiring it
    - foresto 5y ago
      > time-based deletion of messages? That is on their public roadmap, How can deletion of a sent message be enforced? I realize that some messaging services offer this feature, but aren't they all misleading at best? Even on a centralized service with a trustworthy admin, the recipient can always copy/paste or take a screen shot.
samatman 5y ago
Weird objection. I don't think this is solvable even in theory. I mean we have to encrypt with what we have, right? They could use lattices or something (my impression is this would be, er, hard on the battery, but that's a vague impression), but those could be cracked as well. They could be cracked first! Let's just say it's a risk I'm willing to take, given that the alternatives appear to be either my messages being public right now, or communicating by snail mail and carrier pigeon.
- goodpoint 5y ago
  > I don't think this is solvable even in theory. It is very solvable in practice. If I encrypt a TCP connection with AES (e.g. SSL) between my home and your home very few attackers have the ability and budget to capture that traffic, store it for decades and break AES with some quantum-or-whatever computers in year 2050. NSA and perhaps few others. On the other hand, if encrypted data is shared publicly on DHT, a replicated database, a blockchain or similar, in year 2050 your nephews will see grandpa's entire message history. On a practical level, that's a huge difference.
  - samatman 5y ago
    That's a reasonable point I suppose, although a private Matrix server is just a fat peer from this perspective. Unless its database lasts 50 years, those messages are just as gone, and Matrix (I think?) uses TLS in addition to E2E. Score a point for urbit I guess: any channel is limited to those peers participating in it, so Mallory would have to get her hands on one of the planets which received the messages. There is no central point of failure because there is no privileged server.
Arathorn 5y ago
Obviously this is true of any encrypted chat system. Anyone could be recording your encrypted network traffic as we speak, your conversations will be busted wide open! It's nothing to do with Matrix. If you're talking about the fact that Matrix stores your encrypted conversation history by default on the server: a) you can set history retention per room, b) if we saw a vulnerability in the encryption we could always go and re-encrypt the history (although it's a bit of a lost cause by that point :)
- goodpoint 5y ago
  No, read the other answers.
  - Arathorn 5y ago
    > On the other hand, if encrypted data is shared publicly on DHT, a replicated database, a blockchain or similar, in year 2050 your nephews will see grandpa's entire message history. No, Matrix isn’t a public database or a blockchain. The conversations only are only replicated between the servers whose users participate in that given conversation. You might as well be panicking about PGP archives getting compromised, or backups of devices with Signal history on them, etc.
    - krick 5y ago
      > You might as well be panicking about PGP archives getting compromised I don't have a strong opinion on that, but this doesn't sound like an unreasonable thing to worry about. Maybe 20 years ago it seemed like some sci-fi stuff and nobody really thought about it. But then, let's be honest, nobody really thought about e2e encryption back then either. Now this stuff may be not truly an impending disaster yet, but, actually, not so far from it either. Not a big "no-no" yet, but definitely something to be thinking about. And, honestly, I do actually feel uneasy about trusting any secrets with 50+ years expiration date to some integer factorization crypto. Maybe there won't be any practical possibilities to break that in the next 50 years, maybe there will, who knows: but it simply isn't so outrageous of an idea anymore to bet against it. And that's kind of the purpose of cryptography: exaggerating even slightly outrageous possibilities.
kyruzic 5y ago
It relies on the idea of encryption being safe forever in the same way any other program does. If somehow the encryption used is broken you will have a lot more to worry about than your messages.

Not only Matrix leaks metadata all over the place, but it relies on the idea of encryption being safe FOREVER. In 30 or 40 years all your messages might be public.

hellcow 5y ago

They use perfect forward secrecy through OLM, no?

blendergeek 5y ago
"Perfect Forward Secrecy", better termed "Forward Secrecy", allows old messages to remain secret even if the long-term secrets are leaked. If current cryptographic primitives are fundamentally broken, all data can be decrypted if it is saved. This is why it is safest to destroy everything if you are worried about threats in the distant future.
- hellcow 5y ago
  Got it. So the concern is that there's no support for time-based deletion of messages? That is on their public roadmap, and I think it's reasonable to assume that'll be deployed before modern ECC is broken. Or am I misunderstanding the concern?
  - goodpoint 5y ago
    You cannot delete encrypted data once it has been shared with the whole world.
    - kitkat_new 5y ago
      messages don't get shared with the whole world, but only the users and the homeservers the users choose
  - blendergeek 5y ago
    The main concern is that the encrypted data is stored on the server long-term. The longer it is on the server, the more likely it becomes that it is saved by an adversary. If data is only stored for a minimal amount of time, we lower the risk of an adversary acquiring it
  - foresto 5y ago
    > time-based deletion of messages? That is on their public roadmap, How can deletion of a sent message be enforced? I realize that some messaging services offer this feature, but aren't they all misleading at best? Even on a centralized service with a trustworthy admin, the recipient can always copy/paste or take a screen shot.

samatman 5y ago

Weird objection. I don't think this is solvable even in theory. I mean we have to encrypt with what we have, right? They could use lattices or something (my impression is this would be, er, hard on the battery, but that's a vague impression), but those could be cracked as well. They could be cracked first! Let's just say it's a risk I'm willing to take, given that the alternatives appear to be either my messages being public right now, or communicating by snail mail and carrier pigeon.

goodpoint 5y ago
> I don't think this is solvable even in theory. It is very solvable in practice. If I encrypt a TCP connection with AES (e.g. SSL) between my home and your home very few attackers have the ability and budget to capture that traffic, store it for decades and break AES with some quantum-or-whatever computers in year 2050. NSA and perhaps few others. On the other hand, if encrypted data is shared publicly on DHT, a replicated database, a blockchain or similar, in year 2050 your nephews will see grandpa's entire message history. On a practical level, that's a huge difference.
- samatman 5y ago
  That's a reasonable point I suppose, although a private Matrix server is just a fat peer from this perspective. Unless its database lasts 50 years, those messages are just as gone, and Matrix (I think?) uses TLS in addition to E2E. Score a point for urbit I guess: any channel is limited to those peers participating in it, so Mallory would have to get her hands on one of the planets which received the messages. There is no central point of failure because there is no privileged server.

Arathorn 5y ago

Obviously this is true of any encrypted chat system. Anyone could be recording your encrypted network traffic as we speak, your conversations will be busted wide open! It's nothing to do with Matrix. If you're talking about the fact that Matrix stores your encrypted conversation history by default on the server: a) you can set history retention per room, b) if we saw a vulnerability in the encryption we could always go and re-encrypt the history (although it's a bit of a lost cause by that point :)

goodpoint 5y ago
No, read the other answers.
- Arathorn 5y ago
  > On the other hand, if encrypted data is shared publicly on DHT, a replicated database, a blockchain or similar, in year 2050 your nephews will see grandpa's entire message history. No, Matrix isn’t a public database or a blockchain. The conversations only are only replicated between the servers whose users participate in that given conversation. You might as well be panicking about PGP archives getting compromised, or backups of devices with Signal history on them, etc.
  - krick 5y ago
    > You might as well be panicking about PGP archives getting compromised I don't have a strong opinion on that, but this doesn't sound like an unreasonable thing to worry about. Maybe 20 years ago it seemed like some sci-fi stuff and nobody really thought about it. But then, let's be honest, nobody really thought about e2e encryption back then either. Now this stuff may be not truly an impending disaster yet, but, actually, not so far from it either. Not a big "no-no" yet, but definitely something to be thinking about. And, honestly, I do actually feel uneasy about trusting any secrets with 50+ years expiration date to some integer factorization crypto. Maybe there won't be any practical possibilities to break that in the next 50 years, maybe there will, who knows: but it simply isn't so outrageous of an idea anymore to bet against it. And that's kind of the purpose of cryptography: exaggerating even slightly outrageous possibilities.

kyruzic 5y ago

It relies on the idea of encryption being safe forever in the same way any other program does. If somehow the encryption used is broken you will have a lot more to worry about than your messages.