3 ms·

I wanted to change Matrix for XMPP, now I have one less reason to do so.

by po1nt 5y ago

topdancing 5y ago
Most of the problems described here also apply to Matrix. Also came up on Reddit: https://reddit.com/r/PrivacyGuides/comments/qkhqf7/xmpp_admininthemiddle/ https://reddit.com/r/PrivacyGuides/comments/qkhqf7/xmpp_admi...
Semaphor 5y ago
If only Matrix had nice clients like Conversation or Gajim instead of all those mIRC and Discord look-alikes.
- ptman 5y ago
  Which matrix clients have you tried? Fluffychat?
  - Semaphor 5y ago
    I tried elements and looked at all the screenshots of non-alpha clients on https://matrix.org/clients/ https://matrix.org/clients/ Fluffychat would be okay for mobile. But that still leaves me without a primary client on my Windows PC.
edhelas 5y ago
Those issue applies as well to the Matrix network since the global architecture is similar :)
MattJ100 5y ago
Basically all the issues listed in the article apply equally to Matrix, and most other communication platforms too. There are some alternatives that overcome most of the issues with a "serverless" approach (hint: no practical communication protocol on the internet is ever truly serverless), such as Briar. However they generally have UI/UX and feature limitations that are impractical barriers to mass adoption. If you're concerned that your communications may be specifically targeted, you should definitely consider carefully what solution meets your needs and security in the context of your threat model. Sometimes this might be self-hosting, or a pseudonymous XMPP account accessed via Tor, Signal or Matrix, or Briar, or something else. What we need are good factual unbiased guides to inform people about the practical and security properties of various options. Unfortunately this article is not in that category.
southerntofu 5y ago
In matrix, not only can your homeserver usually impersonate you, but most information/history in rooms is considered public and archived forever. I haven't followed recently if there were mitigations on this topic, but that was historically one of the reasons many activists stuck with IRC/XMPP who support ephemeral discussions and/or an explicit data retention policies (eg. keep the latest 20 messages in this room so newcomers can have a little backlog). In case that wasn't clear, in the XMPP model, the backlog for a room is kept on the room's server, not on every individual home server. In matrix, all data is replicated on all servers (which eats massive server resources, although newer implementations like conduit seem to improve on that) which greatly increases the possibilities for a bad actor to find their way to these conversations.
- gefhfff 5y ago
  > who support ephemeral discussions and/or an explicit data retention policies Matrix's variant of that: https://brendan.abolivier.bzh/matrix-retention-policies/ https://brendan.abolivier.bzh/matrix-retention-policies/ > In case that wasn't clear, in the XMPP model, the backlog for a room is kept on the room's server, not on every individual home server. In Which makes your history dependent on a plethora of different servers. Result: very bad usability > replicated on all servers No, this is misleading. It is replicated between servers that have users participating in the conversation, i.e. know the conversation anyways > which eats massive server resources I'd like to have a source for that. To my knowledge Matrix cryptographically verifying actions between servers (prohibiting various bad actions due to the decentralized nature of rooms in Matrix) and the implied DAG is really what needs resources

I wanted to change Matrix for XMPP, now I have one less reason to do so.

by po1nt 5y ago

I wanted to change Matrix for XMPP, now I have one less reason to do so.

Most of the problems described here also apply to Matrix. Also came up on Reddit: https://reddit.com/r/PrivacyGuides/comments/qkhqf7/xmpp_admininthemiddle/ https://reddit.com/r/PrivacyGuides/comments/qkhqf7/xmpp_admi...

Semaphor 5y ago

If only Matrix had nice clients like Conversation or Gajim instead of all those mIRC and Discord look-alikes.

ptman 5y ago
Which matrix clients have you tried? Fluffychat?
- Semaphor 5y ago
  I tried elements and looked at all the screenshots of non-alpha clients on https://matrix.org/clients/ https://matrix.org/clients/ Fluffychat would be okay for mobile. But that still leaves me without a primary client on my Windows PC.

edhelas 5y ago

Those issue applies as well to the Matrix network since the global architecture is similar :)

MattJ100 5y ago

Basically all the issues listed in the article apply equally to Matrix, and most other communication platforms too. There are some alternatives that overcome most of the issues with a "serverless" approach (hint: no practical communication protocol on the internet is ever truly serverless), such as Briar. However they generally have UI/UX and feature limitations that are impractical barriers to mass adoption. If you're concerned that your communications may be specifically targeted, you should definitely consider carefully what solution meets your needs and security in the context of your threat model. Sometimes this might be self-hosting, or a pseudonymous XMPP account accessed via Tor, Signal or Matrix, or Briar, or something else. What we need are good factual unbiased guides to inform people about the practical and security properties of various options. Unfortunately this article is not in that category.

southerntofu 5y ago

In matrix, not only can your homeserver usually impersonate you, but most information/history in rooms is considered public and archived forever. I haven't followed recently if there were mitigations on this topic, but that was historically one of the reasons many activists stuck with IRC/XMPP who support ephemeral discussions and/or an explicit data retention policies (eg. keep the latest 20 messages in this room so newcomers can have a little backlog). In case that wasn't clear, in the XMPP model, the backlog for a room is kept on the room's server, not on every individual home server. In matrix, all data is replicated on all servers (which eats massive server resources, although newer implementations like conduit seem to improve on that) which greatly increases the possibilities for a bad actor to find their way to these conversations.

gefhfff 5y ago
> who support ephemeral discussions and/or an explicit data retention policies Matrix's variant of that: https://brendan.abolivier.bzh/matrix-retention-policies/ https://brendan.abolivier.bzh/matrix-retention-policies/ > In case that wasn't clear, in the XMPP model, the backlog for a room is kept on the room's server, not on every individual home server. In Which makes your history dependent on a plethora of different servers. Result: very bad usability > replicated on all servers No, this is misleading. It is replicated between servers that have users participating in the conversation, i.e. know the conversation anyways > which eats massive server resources I'd like to have a source for that. To my knowledge Matrix cryptographically verifying actions between servers (prohibiting various bad actions due to the decentralized nature of rooms in Matrix) and the implied DAG is really what needs resources