5 ms·

The fact that content sent to signal and Whatsapp resides unencrypted at the matrix homeserver makes this product completely useless to me. I don't think I wan

The fact that content sent to signal and Whatsapp resides unencrypted at the matrix homeserver makes this product completely useless to me. I don't think I want to sacrifice the security for having all my chats in one place. If they can fix that I might reconsider. They already reverse engineered the Whatsapp protocol. I see little reason why it can't live in the client? I don't really follow why they move the bridge to the homeserver.

radicalbyte 5y ago
WhatsApp's backups are already stored unencrypted* on Google Drive if you use that feature. * Encrypted with a private key which Google have access to.
- bogwog 5y ago
  So the encryption is there so that you can't access your own data (and migrate to a competing app/service), rather than to protect your privacy. I kind of ran into this issue myself when I was helping a family member move to iPhone. Since Whatsapp uses Drive on Android and iCloud on iOS, there was no way to transfer the data. I wonder if you can get them via one of those data access requests?
iforgotpassword 5y ago
Why don't you encrypt your hard drive?
- krageon 5y ago
  What problem do you feel this would solve?
- arianvanp 5y ago
  I don't follow. What does my hard drive have to do with plaintext messages on Element's servers?
  - square_usual 5y ago
    As far as I can tell, the messages don't live in plaintext on Element's servers - they are bridged in plaintext to Matrix, which is end to end encrypted.
  - iforgotpassword 5y ago
    Aj, my bad. I skimmed over the part where it says they are hosting the bridge for you. Since matrix is focused on privacy etc I assumed this is available as a container/VM I can run at home or on a VPS. Indeed then very weird why I should trust them more with my personal data than anybody else.
    - IceWreck 5y ago
      > Since matrix is focused on privacy etc I assumed this is available as a container/VM I can run at home or on a VPS. All bridges, and the matrix homeserver itself have been open source and self-hostable for years. I host a homeserver + some bridges myself. This is just the sugar-coated SaaS for people who dont want to do it themselves.
    - KoftaBob 5y ago
      > Since matrix is focused on privacy etc I assumed this is available as a container/VM I can run at home or on a VPS. It is! https://matrix.org/bridges/ https://matrix.org/bridges/
miguelrochefort 5y ago
> They already reverse engineered the Whatsapp protocol. I see little reason why it can't live in the client? I don't really follow why they move the bridge to the homeserver. Matrix bridges are rather complex. They rely on a combination of private APIs (WhatsApp), Chrome extension scraping (LINE), bots (Telegram), mobile clients (Android SMS), and jailbroken iPhones (iMessage).
- have_faith 5y ago
  This is all very interesting from a technological perspective but it sounds incredible brittle. Do I break any terms with these 3rd parties by paying Matrix to scrape them?
  - miguelrochefort 5y ago
    I've been using Beeper.com for a while and it's surprisingly stable despite how brittle one would expect these bridges to be. Given that puppeteering should be indistinguishable from real application usage and that $5/month/user should be more than enough to diversify IP addresses, I suspect the model can actually be sustainable in the long term.
    - ev1 5y ago
      I'm kind of curious how Beeper will handle some of these - they claim to soon support WeChat, and emulating WeChat is a bit insane, because it collects so much data that it's a walking GDPR violation, there's no way to stop it, and we are talking things like "please repeat the numbers in chinese, then english, while looking straight into your phone" at login.
      - spurgu 5y ago
        Uff, that sounds insane. I suppose they released those "features" gradually and people just went along.
        5y ago
chayleaf 5y ago
they haven't, they simply host a VM with Whatsapp and connect to it via Whatsapp Web
liotier 5y ago
> They already reverse engineered the Whatsapp protocol. I see little reason why it can't live in the client ? Because Whatsapp crushes any client other than their official client. Everyone else is confined to scraping Whatsapp Web.
- kjaftaedi 5y ago
  At least it's better than getting zero-clicked.
kirimita 5y ago
Data does not _reside_ unencrypted with End to Bridge Encryption : https://docs.mau.fi/bridges/general/end-to-bridge-encryption.html https://docs.mau.fi/bridges/general/end-to-bridge-encryption...
- arianvanp 5y ago
  But the bridge is not hosted by me but by them. I need to trust matrix not to MITM me
  - tremon 5y ago
    Yes, in the same way that you need to trust Whatsapp not to MITM you. What's your perceived difference between these trust levels, other than one is something you pay for with money, and the other doesn't require money?
    - grassjumper 5y ago
      The Signal protocol (which WhatsApp still uses, I presume) is very good. WhatsApp can't MITM it. Element, on the other hand, is MITM by design.
    - axelthegerman 5y ago
      THIS "in the same way that you need to trust Whatsapp not to MITM" And on top of that Google or Apple or whoever you "trust" with your mobile operating system of choice. Speaking of mobile OS, Element will likely run fine on mobile Linux whereas you can be sure Whatsapp will never release a Linux client

radicalbyte 5y ago

WhatsApp's backups are already stored unencrypted* on Google Drive if you use that feature. * Encrypted with a private key which Google have access to.

bogwog 5y ago
So the encryption is there so that you can't access your own data (and migrate to a competing app/service), rather than to protect your privacy. I kind of ran into this issue myself when I was helping a family member move to iPhone. Since Whatsapp uses Drive on Android and iCloud on iOS, there was no way to transfer the data. I wonder if you can get them via one of those data access requests?

iforgotpassword 5y ago

Why don't you encrypt your hard drive?

krageon 5y ago
What problem do you feel this would solve?
arianvanp 5y ago
I don't follow. What does my hard drive have to do with plaintext messages on Element's servers?
- square_usual 5y ago
  As far as I can tell, the messages don't live in plaintext on Element's servers - they are bridged in plaintext to Matrix, which is end to end encrypted.
- iforgotpassword 5y ago
  Aj, my bad. I skimmed over the part where it says they are hosting the bridge for you. Since matrix is focused on privacy etc I assumed this is available as a container/VM I can run at home or on a VPS. Indeed then very weird why I should trust them more with my personal data than anybody else.
  - IceWreck 5y ago
    > Since matrix is focused on privacy etc I assumed this is available as a container/VM I can run at home or on a VPS. All bridges, and the matrix homeserver itself have been open source and self-hostable for years. I host a homeserver + some bridges myself. This is just the sugar-coated SaaS for people who dont want to do it themselves.
  - KoftaBob 5y ago
    > Since matrix is focused on privacy etc I assumed this is available as a container/VM I can run at home or on a VPS. It is! https://matrix.org/bridges/ https://matrix.org/bridges/

miguelrochefort 5y ago

> They already reverse engineered the Whatsapp protocol. I see little reason why it can't live in the client? I don't really follow why they move the bridge to the homeserver. Matrix bridges are rather complex. They rely on a combination of private APIs (WhatsApp), Chrome extension scraping (LINE), bots (Telegram), mobile clients (Android SMS), and jailbroken iPhones (iMessage).

have_faith 5y ago
This is all very interesting from a technological perspective but it sounds incredible brittle. Do I break any terms with these 3rd parties by paying Matrix to scrape them?
- miguelrochefort 5y ago
  I've been using Beeper.com for a while and it's surprisingly stable despite how brittle one would expect these bridges to be. Given that puppeteering should be indistinguishable from real application usage and that $5/month/user should be more than enough to diversify IP addresses, I suspect the model can actually be sustainable in the long term.
  - ev1 5y ago
    I'm kind of curious how Beeper will handle some of these - they claim to soon support WeChat, and emulating WeChat is a bit insane, because it collects so much data that it's a walking GDPR violation, there's no way to stop it, and we are talking things like "please repeat the numbers in chinese, then english, while looking straight into your phone" at login.
    - spurgu 5y ago
      Uff, that sounds insane. I suppose they released those "features" gradually and people just went along.
      - 5y ago

chayleaf 5y ago

they haven't, they simply host a VM with Whatsapp and connect to it via Whatsapp Web

liotier 5y ago

> They already reverse engineered the Whatsapp protocol. I see little reason why it can't live in the client ? Because Whatsapp crushes any client other than their official client. Everyone else is confined to scraping Whatsapp Web.

kjaftaedi 5y ago
At least it's better than getting zero-clicked.

kirimita 5y ago

Data does not _reside_ unencrypted with End to Bridge Encryption : https://docs.mau.fi/bridges/general/end-to-bridge-encryption.html https://docs.mau.fi/bridges/general/end-to-bridge-encryption...

arianvanp 5y ago
But the bridge is not hosted by me but by them. I need to trust matrix not to MITM me
- tremon 5y ago
  Yes, in the same way that you need to trust Whatsapp not to MITM you. What's your perceived difference between these trust levels, other than one is something you pay for with money, and the other doesn't require money?
  - grassjumper 5y ago
    The Signal protocol (which WhatsApp still uses, I presume) is very good. WhatsApp can't MITM it. Element, on the other hand, is MITM by design.
  - axelthegerman 5y ago
    THIS "in the same way that you need to trust Whatsapp not to MITM" And on top of that Google or Apple or whoever you "trust" with your mobile operating system of choice. Speaking of mobile OS, Element will likely run fine on mobile Linux whereas you can be sure Whatsapp will never release a Linux client