3 ms·
IMHO, aspects like metadata and application security are often much more important than the cryptographic protocol when assessing the security of a system like
by ThePhysicist 5y ago
IMHO, aspects like metadata and application security are often much more important than the cryptographic protocol when assessing the security of a system like a messenger. People e.g. love to celebrate the Signal protocol because of its double-ratchet key rotation scheme, which is of course great and provides a little bit of additional security, but the other technical and organizational aspects of the system are just as important to assure privacy and security.
From that angle I like systems like Matrix way more than centralized solutions like Signal, Threema etc., because the whole security and privacy guarantees of the latter can be completely nullified by a single software update. If users don't have full control over the software running on the endpoint then end to end encryption is little more than a marketing gag, IMHO.
- southerntofu 5y agoUnless something has changed in the past years, Signal and Matrix have this in common that any room you join displays your identifier for every one to see (phone number / MXID) publicly, leading to problems of harassment/spam. But i entirely agree with your point that relying on a single actor for updates/security is really the worst.
- phicoh 5y agoI'd say that revealing a phone number is probably worse than a matrix ID. But indeed, it would be nice if miatrix clients from element would support multiple identities. Then you can join a room with a disposable account.
- Zash 5y agoOne of the nice things with XMPP, where in public channels your address is generally only shown to room moderators, not to all participants.
- mikro2nd 5y agoAn project that looks interesting to me is Cwtch, precisely for its focus on metadata leak-resistance. It seems to be more of a research-focussed project right now, but I think looking in exactly the right direction.