9 ms·

With the recent dust-up around protonmail's "end-to-end encryption", it's hard for me to believe that the hammer isn't going to come down on Matrix in a similar

With the recent dust-up around protonmail's "end-to-end encryption", it's hard for me to believe that the hammer isn't going to come down on Matrix in a similar way. Nobody has seriously turned their attention to the compromised-homeserver issue, even though that's the only threat model under which e2ee makes sense. Expecting users in hundred-person group chats to manually verify each other individual user's keys is nonsensical. And even a single unverified key means that their homeserver operator could be listening in. I feel like Matrix should move more towards emphasizing how easy it is to self-host and maintain control of your own Matrix data, making e2ee is a non-issue.

COGlory 5y ago
What dustup around end-to-end encryption? I'm only familiar with ProtonMail's IP logging controversy. I was unaware it impacted E2E at all?
- deleted 5y ago
  [deleted]
- abnercoimbre 5y ago
  Did you find further information? Would've been nice for the GP to point to a source or news item.
- 0xdeadb00f 5y ago
  I'm pretty sure OP is just misinformed. That, or they're talking about that one huge hole in PM's PGP implementation years and years ago.
- nightpool 5y ago
  Right, the dust-up was "PM advertises their service as secure and end-to-end encrypted, but in practice that doesn't mean much because user access is non-anonymous and they're still a central metadata honeypot for any law enforcement agency to log accesses to" (compared to e.g. Signal which AIUI is designed as an anonymous dropbox so that Signal can't correlate between user access to their servers and individual senders)
dkasak 5y ago
Realistically, when would you be in a hundred-person encrypted group? Mostly this is the case when you're a member of some kind of organization, and there are ideas how to solve this case without pairwise verifying all participants (e.g. by delegating trust through a single trusted person such as the CEO, reducing the number of verifications necessary from N(N+1)/2 to N). Even without this, fully verified E2EE is still feasible and useful for smaller groups. And even if you own the homeserver, you still want E2EE since you don't want the data to rest in plaintext server-side. However, there is work currently being done to make it feasible for every node to also be its own homeserver, via P2P Matrix (https://matrix.org/blog/2020/06/02/introducing-p-2-p-matrix https://matrix.org/blog/2020/06/02/introducing-p-2-p-matrix).
- schmorptron 5y ago
  At uni, it's common to have whatsapp groups for classes, which tend to be encrypted 100 to 200 people WhatsApp groups.
  - zaik 5y ago
    How many of those have verified all the public keys? If you never do verification e2ee is basically meaningless.
    - SahAssar 5y ago
      By that logic the vast majority of users of whatsapp, signal and most other e2ee protocols/apps use it in a useless way, right? Most people I know who use these apps (even the security-conscious ones) never verified the key.
      - BHSPitMonkey 5y ago
        Signal tells you outright when someone's key has changed, though. It's usually pretty trivial to establish that the original conversation is authentic when you're just talking with people you know in real life (where an impersonation attempt would likely fail for numerous reasons), and you can assume that device is still theirs until their key changes.
miloignis 5y ago
Even if it's not currently practical for 100 person group chats, verifying each other's keys is quite practical for 1on1 or other small groups of say 10 people or so, and you get a great benefit from doing so! Two normal users could use any matrix server, including the huge matrix.org one, and communicate privately in a direct chat with peace of mind. Of course, I think self-hosting and decentralizing the servers is very important and good work too!
Youden 5y ago
> I feel like Matrix should move more towards emphasizing how easy it is to self-host and maintain control of your own Matrix data, making e2ee is a non-issue. Matrix is way ahead of you. There's ongoing work to build P2P clients [0]. That is, each phone/device can be its own home server. The latest update was in May [1]. [0]: https://matrix.org/blog/2020/06/02/introducing-p-2-p-matrix https://matrix.org/blog/2020/06/02/introducing-p-2-p-matrix [1]: https://matrix.org/blog/2021/05/06/introducing-the-pinecone-overlay-network https://matrix.org/blog/2021/05/06/introducing-the-pinecone-...
- progval 5y ago
  It still does not solve key distribution. Matrix P2P removes the homeservers, but clients are still talking to each other through some medium that can impersonate them. There's really no magic solution to solve this, you need either a trusted third-party (such as Certificate Authorities, who are expensive) or a Web of Trust (impractical for users).
  - Arathorn 5y ago
    Matrix's existing E2EE has identity verification as effectively one- or two-hop web-of-trust using QR codes or emoji comparisons. It's not impractical for users, because everyone's familiar these days with scanning a QR code as a mechanism for logging into an app (c.f. Discord, WhatsApp, Signal etc). So as long as you scan the people whose identity you care about, you're sorted, and it's much easier for normal users than the clunky old PGP signing parties of years gone by (plus it doesn't leak as much metadata, given it's just one or two hops of trust).
    - brunoqc 5y ago
      Can we get a arewep2pyet.org ? Maybe the wait would be more bearable ;) Or if you prefer threats: "If I die from covid before matrix p2p is a thing, my ghost will haunt you for evar!".
      - Arathorn 5y ago
liotier 5y ago
> Matrix should move more towards emphasizing how easy it is to self-host They are already moving beyond that - towards P2P Matrix, with a network mixing traditional servers and individual nodes that collapse client and server: https://matrix.org/blog/2021/05/06/introducing-the-pinecone-overlay-network https://matrix.org/blog/2021/05/06/introducing-the-pinecone-...
zaik 5y ago
> Expecting users in hundred-person group chats to manually verify each other individual user's keys is nonsensical. Maybe this could be helped if Matrix clients supported OpenPGP encryption which allows for key signing/web of trust? Some XMPP clients already have OpenPGP support, it would be nice to one day be able to send encrypted messages to Matrix users.
ajconway 5y ago
The possibility to perform manual or semi-automated (QR code) key verification is still useful. 1. Those who care about encryption are able to verify their keys. 2. The service can't implement mass-surveillance in secret if there are at least two random users who verify their keys.
garaetjjte 5y ago
>I feel like Matrix should move more towards emphasizing how easy it is to self-host and maintain control of your own Matrix data The problem is, it isn't easy at all. Running homeserver requires gigabytes of RAM and significant CPU performance to work at usable speeds. It just isn't feasible to run it on some dirt cheap VPS, you need beefy machine.
- Semaphor 5y ago
  Why does it require that much? I run a Jabber server, and it barely uses any resources on my VPS. Unless you mean for significant users?
  - garaetjjte 5y ago
    If you want to actually use the federating feature, you will probably join some big channels. And that causes pulling of some huge amount of data from other homeservers. disclaimer: I tested it some time ago with Synapse. Now I see there is also new homeserver software, Dendrite. It is possible that it is order of magnitude less resource hungry, though I wouldn't count on that.
    - callahad 5y ago
      One of our primary goals on the Synapse last quarter was to make it possible for a new homeserver to join Matrix HQ (a large, public room) in under 1 GB of RAM. And we did it. https://matrix.org/blog/2021/06/15/synapse-1-36-0-released https://matrix.org/blog/2021/06/15/synapse-1-36-0-released It's not the slimmest beast, in part because Synapse needs to scale up to country-scale deployments, but its ability to scale down has significantly improved over the past year. That said, Dendrite and Conduit (https://gitlab.com/famedly/conduit/ https://gitlab.com/famedly/conduit/) are exciting projects which will optimize for different operational contexts.
    - aasasd 5y ago
      How and why is that different from a client being in the room? I'm pretty sure that neither desktop, nor especially phone clients are supposed to take gigabytes of mem to listen to chats.

COGlory 5y ago

What dustup around end-to-end encryption? I'm only familiar with ProtonMail's IP logging controversy. I was unaware it impacted E2E at all?

deleted 5y ago
[deleted]
abnercoimbre 5y ago
Did you find further information? Would've been nice for the GP to point to a source or news item.
0xdeadb00f 5y ago
I'm pretty sure OP is just misinformed. That, or they're talking about that one huge hole in PM's PGP implementation years and years ago.
nightpool 5y ago
Right, the dust-up was "PM advertises their service as secure and end-to-end encrypted, but in practice that doesn't mean much because user access is non-anonymous and they're still a central metadata honeypot for any law enforcement agency to log accesses to" (compared to e.g. Signal which AIUI is designed as an anonymous dropbox so that Signal can't correlate between user access to their servers and individual senders)

dkasak 5y ago

Realistically, when would you be in a hundred-person encrypted group? Mostly this is the case when you're a member of some kind of organization, and there are ideas how to solve this case without pairwise verifying all participants (e.g. by delegating trust through a single trusted person such as the CEO, reducing the number of verifications necessary from N(N+1)/2 to N). Even without this, fully verified E2EE is still feasible and useful for smaller groups. And even if you own the homeserver, you still want E2EE since you don't want the data to rest in plaintext server-side. However, there is work currently being done to make it feasible for every node to also be its own homeserver, via P2P Matrix (https://matrix.org/blog/2020/06/02/introducing-p-2-p-matrix https://matrix.org/blog/2020/06/02/introducing-p-2-p-matrix).

schmorptron 5y ago
At uni, it's common to have whatsapp groups for classes, which tend to be encrypted 100 to 200 people WhatsApp groups.
- zaik 5y ago
  How many of those have verified all the public keys? If you never do verification e2ee is basically meaningless.
  - SahAssar 5y ago
    By that logic the vast majority of users of whatsapp, signal and most other e2ee protocols/apps use it in a useless way, right? Most people I know who use these apps (even the security-conscious ones) never verified the key.
    - BHSPitMonkey 5y ago
      Signal tells you outright when someone's key has changed, though. It's usually pretty trivial to establish that the original conversation is authentic when you're just talking with people you know in real life (where an impersonation attempt would likely fail for numerous reasons), and you can assume that device is still theirs until their key changes.

miloignis 5y ago

Even if it's not currently practical for 100 person group chats, verifying each other's keys is quite practical for 1on1 or other small groups of say 10 people or so, and you get a great benefit from doing so! Two normal users could use any matrix server, including the huge matrix.org one, and communicate privately in a direct chat with peace of mind. Of course, I think self-hosting and decentralizing the servers is very important and good work too!

Youden 5y ago

> I feel like Matrix should move more towards emphasizing how easy it is to self-host and maintain control of your own Matrix data, making e2ee is a non-issue. Matrix is way ahead of you. There's ongoing work to build P2P clients [0]. That is, each phone/device can be its own home server. The latest update was in May [1]. [0]: https://matrix.org/blog/2020/06/02/introducing-p-2-p-matrix https://matrix.org/blog/2020/06/02/introducing-p-2-p-matrix [1]: https://matrix.org/blog/2021/05/06/introducing-the-pinecone-overlay-network https://matrix.org/blog/2021/05/06/introducing-the-pinecone-...

progval 5y ago
It still does not solve key distribution. Matrix P2P removes the homeservers, but clients are still talking to each other through some medium that can impersonate them. There's really no magic solution to solve this, you need either a trusted third-party (such as Certificate Authorities, who are expensive) or a Web of Trust (impractical for users).
- Arathorn 5y ago
  Matrix's existing E2EE has identity verification as effectively one- or two-hop web-of-trust using QR codes or emoji comparisons. It's not impractical for users, because everyone's familiar these days with scanning a QR code as a mechanism for logging into an app (c.f. Discord, WhatsApp, Signal etc). So as long as you scan the people whose identity you care about, you're sorted, and it's much easier for normal users than the clunky old PGP signing parties of years gone by (plus it doesn't leak as much metadata, given it's just one or two hops of trust).
  - brunoqc 5y ago
    Can we get a arewep2pyet.org ? Maybe the wait would be more bearable ;) Or if you prefer threats: "If I die from covid before matrix p2p is a thing, my ghost will haunt you for evar!".
    - Arathorn 5y ago

liotier 5y ago

> Matrix should move more towards emphasizing how easy it is to self-host They are already moving beyond that - towards P2P Matrix, with a network mixing traditional servers and individual nodes that collapse client and server: https://matrix.org/blog/2021/05/06/introducing-the-pinecone-overlay-network https://matrix.org/blog/2021/05/06/introducing-the-pinecone-...

zaik 5y ago

> Expecting users in hundred-person group chats to manually verify each other individual user's keys is nonsensical. Maybe this could be helped if Matrix clients supported OpenPGP encryption which allows for key signing/web of trust? Some XMPP clients already have OpenPGP support, it would be nice to one day be able to send encrypted messages to Matrix users.

ajconway 5y ago

The possibility to perform manual or semi-automated (QR code) key verification is still useful. 1. Those who care about encryption are able to verify their keys. 2. The service can't implement mass-surveillance in secret if there are at least two random users who verify their keys.

garaetjjte 5y ago

>I feel like Matrix should move more towards emphasizing how easy it is to self-host and maintain control of your own Matrix data The problem is, it isn't easy at all. Running homeserver requires gigabytes of RAM and significant CPU performance to work at usable speeds. It just isn't feasible to run it on some dirt cheap VPS, you need beefy machine.

Semaphor 5y ago
Why does it require that much? I run a Jabber server, and it barely uses any resources on my VPS. Unless you mean for significant users?
- garaetjjte 5y ago
  If you want to actually use the federating feature, you will probably join some big channels. And that causes pulling of some huge amount of data from other homeservers. disclaimer: I tested it some time ago with Synapse. Now I see there is also new homeserver software, Dendrite. It is possible that it is order of magnitude less resource hungry, though I wouldn't count on that.
  - callahad 5y ago
    One of our primary goals on the Synapse last quarter was to make it possible for a new homeserver to join Matrix HQ (a large, public room) in under 1 GB of RAM. And we did it. https://matrix.org/blog/2021/06/15/synapse-1-36-0-released https://matrix.org/blog/2021/06/15/synapse-1-36-0-released It's not the slimmest beast, in part because Synapse needs to scale up to country-scale deployments, but its ability to scale down has significantly improved over the past year. That said, Dendrite and Conduit (https://gitlab.com/famedly/conduit/ https://gitlab.com/famedly/conduit/) are exciting projects which will optimize for different operational contexts.
  - aasasd 5y ago
    How and why is that different from a client being in the room? I'm pretty sure that neither desktop, nor especially phone clients are supposed to take gigabytes of mem to listen to chats.