4 ms·
That’s a blast from the past for me! Some years ago, in 2014 or so, at a small startup I was in, we tried to make all communication encrypted. So we had as an
by shp0ngle 5y ago
That’s a blast from the past for me!
Some years ago, in 2014 or so, at a small startup I was in, we tried to make all communication encrypted. So we had as an official communication channel just Jabber and OTR. (Note, it was before Slack existed.) We did not have official client, everyone could use their own one.
It was a nightmare. No 2 clients were really compatible, and the various failure states were not properly implemented, so we routinely could not read each other messages and felt back to plaintext and “I cannot read what you said? please reply back here”
This was so bad that we then switched to just PGP mails (which had its own drawbacks, but at least worked).
I am not there anymore, I think they switched to just using Slack now. But they could Signal.
- seniorivn 5y agothere is more reliable open source decentralized alternative to jabber matrix.org
- shp0ngle 5y agoDidn’t matrix add e2e just recently?
- jeroenhd 5y agoI'm not sure on the exact timeline, but E2EE has been mentioned in references to the protocol going back as far as 2015. However, because of a lack of cross-signing support, it was disabled by default for a long time. The protocol and UX improvements to allow multi-client multi-receiver end-to-end-encrypted messages came in about a year or two ago, which precluded the need for every user to verify every device of every other user they're talking to. The default flow is to verify each of your devices yourself, and others verify against your key only once. However, it's technically not required to cross-sign your keys, so it's perfectly possible to force others to verify each device of yours if you want to enforce some extra security. Not very practical, though. So: protocol wise, encryption has been in there for a while, but client support and ease of use were major constraints. Modern cross-signing support (and uptake of encrypted messages by alternative clients) have helped a lot in actual adoption of the encryption abilities the protocol already had.
- Arathorn 5y agowe added e2ee in beta in nov 2016 (https://matrix.org/blog/2016/11/21/matrixs-olm-end-to-end-encryption-security-assessment-released-and-implemented-cross-platform-on-riot-at-last/ https://matrix.org/blog/2016/11/21/matrixs-olm-end-to-end-en...) and exited beta and enabled it by default in may 2020: https://matrix.org/blog/2020/05/06/cross-signing-and-end-to-end-encryption-by-default-is-here https://matrix.org/blog/2020/05/06/cross-signing-and-end-to-...