10 ms·
Element (Matrix) launches Chatterbox, end-to-end encrypted embedded chat
- midislack 4y agoBonus - unlike Signal they don't need your phone number or DNA...
- deleted 4y ago[deleted]
- warning26 4y agoDoes it have export? Signal's complete inability to any kind of history backup is a dealbreaker for me.
- midislack 4y agoJust because there's no "official" way to access history as a client in Signal doesn't mean the history isn't there. You'd have to ask that "Moxie Marlinspike" or whatever his name is fella.
- tcfhgj 4y agoElement has. The app on the other side I think it's unlikely that this chatbox has export functionality
- jeroenhd 4y agoWith E2EE I don't think you can even implement a reliable export on the server side. It seems like Element is limited to only exporting a single room, though. You need something like https://gitlab.com/argit/matrix-recorder/ https://gitlab.com/argit/matrix-recorder/ to export all messages, it seems.
- Pakdef 4y ago> With E2EE I don't think you can even implement a reliable export on the server side. Can't you use your client key(s)?
- woojoo666 4y agoThe client would have to fetch all your messages first. Some rooms can have thousands of messages a day, and some people are in thousands of rooms [1] (though these are core developers so they might be stress testing) [1]: https://news.ycombinator.com/item?id=32021303 https://news.ycombinator.com/item?id=32021303
- Pakdef 4y agobut you would hopefully not export all messages every time? incremental?
- woojoo666 4y agoIf you wanted automated exports I think an easier way would be to host your own homeserver, and create your account on that homeserver. I believe any messages in any rooms you join will be synced with your homeserver, and you can perform automated full backups (or maybe incremental backups if the database supports it?)
- Pakdef 4y ago> Element has it has if the the person who you are chatting with didn't already delete their comment (unless you host your own server and modified it to keep a log of everything)
- hda2 4y ago> Element has. The app on the other side Which is currently broken and has been for some time. If you export a room, images will not show in the final exported chat.
- tcfhgj 4y agoHow does E2EE work here? How can the user know their communication isn't being intercepted?
- Arathorn 4y agoIt’s using normal Matrix olm/megolm double ratchet encryption. To track the identity of who you’re talking to we can do TOFU and/or normal out of band Matrix verification as per https://github.com/vector-im/hydrogen-web/issues/518 https://github.com/vector-im/hydrogen-web/issues/518 - but this isn’t yet exposed in Chatterbox. We’ll get it added, as without verification you obviously can’t spot a MITM.
- remram 4y agoHow does the user check that, if they are running untrusted clients embedded on untrusted sites? Who is the adversary that the addition of end-to-end encryption is supposed to defeat?
- woojoo666 4y agoIf the business doesn't want to host the chat server themselves, they can have a 3rd party provider host it (like Matrix.org) without worrying about the 3rd party having access to the messages Edit: sorry I should have clarified that I was answering your second question. As for the first question, the user still has to trust the business to a certain extent
- t6jvcereio 4y agoIncidentally I tried matrix for the first time on the basis of someone recommending it here in HN, and it's extremely slow
- Arathorn 4y agothis is like saying “i tried the web, and it’s extremely slow”. what server were you using? and which client on which platform?
- ngetchell 4y agoHow about slow compared to Discord?
- 29083011397778 4y agoBut this still doesn't answer the question - did you register on the default server that everyone uses (matrix.org)? And in that case, you've given the exact worse case scenario: The heaviest server, being used by everyone else, with massive rooms, and constantly fighting off spam.
- jeroenhd 4y agoPersonally, I find that the Matrix.org server is much better for large rooms. Most of the content is already cached on the server by all the other accounts on there, so joining large rooms takes seconds instead of minutes. Modern sync (v3 already, I think?) also helps a huge amount but it needs client and server support. I've tried to join the main matrix chat room (#matrix:matrix.org) but my poor homeserver just couldn't handle it.
- feanaro 4y agoModern sync (sliding sync, v3 sync) only helps with non-encrypted rooms. For encrypted rooms, it degrades to essentially the old sync v2 performance.
- bsaul 4y agonot sure i understand what the point is.. Embedded usually means c2b communication, not c2c. The professional you're communicating with is probably already hosting its computer's data on the company's network...
- woojoo666 4y agoThis could be useful for smaller business that don't want to maintain their own servers. Element already provides hosting services for Matrix chat [1]. Businesses can use it, without worrying about messages being exposed to the hosting service. [1]: https://element.io/matrix-services https://element.io/matrix-services
- maxloh 4y agoWhat is the benefit of end to end encryption in this scenario? There is no risk of service provider spying on you because you as the business is the service provider.
- jeroenhd 4y agoThis is part of a hosted package. In theory, this means that the folks over at Element.io can't see the chats between you and your customers/business partners because of the E2EE. That does depend on them not hosting the software, of course, because E2EE becomes useless if the software used to encrypt data can be changed at a whim. With the private keys on the recipient end and the browser end, it does make it easier to follow certain data privacy regulations. Whether the rather leaky Matrix protocol is considered foolproof is still an unanswered question, though; the average encrypted chat session sends a LOT of unique identifiers that shouldn't cause any trouble, but I haven't seen a recent audit of the protocol.
- tcfhgj 4y agoHmm, I'd say it depends. Imagine you're contacting a doctor and are communicating about sensitive stuff. I'd still expect this to been treated relatively confidential, i.e. not spreading it within the company, or potentially leaking it. Plus, the matrix server of the person on the other side might not be in your hands, e.g. hosted by Element
- hda2 4y agoE2EE can prevent the leaking of private conversations to thirdparty middleware/cloud companies. This would allow orgs to continue using those thirdparty services to handle their traffic like usual, but would also guard against middleware disasters like cloudflair's leaking of https traffic. Thanks to the prevalence of early HTTPS termination (usually at the edge of some big cloud company), that green pad lock at the top of your browser means little when true privacy is needed.
- viccuad 4y agoIn addition to points from others: no middleman can tamper with the information being sent (e.g: see how Russia changes content of pages served via http to display war propaganda or ads).
- jeroenhd 4y agoEdit: Github link at [3], couldn't find it when I originally wrote my comment below I wonder how this compares to alternatives like [1] and [2] that you can also host yourself. There was also a Matrix project *that I can't find for the life of me) featuring multi-agent live chat support with multiple agents being able to join and leave a room. I suppose the E2EE support is what sets it apart, though I'm not sure if that's actually a feature you really need. Half the features advertised seem to be existing EMS features (like talking across chat services). I suppose you can use this to portal a web chat box into Slack but honestly I think there are better solutions. [1]: https://github.com/osousa/livematrix https://github.com/osousa/livematrix [2]: https://github.com/nomadic-labs/safesupport-chatbox https://github.com/nomadic-labs/safesupport-chatbox [3]: https://github.com/vector-im/chatterbox https://github.com/vector-im/chatterbox
- Arathorn 4y agoYou can host chatterbox yourself too - it’s apache licensed FOSS (https://github.com/vector-im/chatterbox https://github.com/vector-im/chatterbox).
- jeroenhd 4y agoOh, I see! I was looking under the matrix-org Github account so I couldn't find the source code, I probably should've looked at the vector-im tag as well.
- tcfhgj 4y agoThe former doesn't have encryption, but good question
- osousa 4y agoHi there. I wrote [1] (Thanks for the reference) , and i skipped encryption for the sake of simplicity. I'm enabling encryption as we speak. If you host the server yourself, on a controlled setting (VPS), it should allow for a fairly secure way of communication if TLS is used. The communication channel would resemble this rough ASCII drawing: [Browser] <---TLS---> [livematrix] <---e2ee---> [Matrix homeserver] In the end you always have to trust the person hosting the service. Host things yourself. I don't see this channel of communication as being truly secure, without audits where and how its deployed. Web apps are riddled with vulnerabilities, how much of the attack surface from a website would compromise the live chat embedded is a guess until it happens. I should point out that my "solution" is intended for personal websites, people who enjoy Matrix a lot :) . Not for corporations at all.
- theogravity 4y agoI'm not familiar with pricing in this space, but $3.80 / MAU (says $3 for element product, then 0.80 for the chatterbox product on top) seems really expensive that you would have very specific use-cases (government, hospitals?) to use the product to want to pay the price for it.
- Arathorn 4y agoIt’s $3/MAU for the users who are using a fullblown Matrix client like Element on the server. Meanwhile users who are coming in via the lightweight Chatterbox client are only $0.80/MAU. And users who come in via federation are free. We’ll see how the pricing fares in practice.
- halostatue 4y agoYeah. I can’t see any of the clients who are using our live chat solution paying almost $1/customer for chat. That would raise the bills of many of our clients by thousands of dollars a month.
- encryptluks2 4y agoThis is just another firm reminder that Matrix isn't the revolution against IRC/XMPP and instead is just a company running Microsoft's playbook.
- smotched 4y agoHow so?
- encryptluks2 4y agoBecause they are in the "extend" phase.
- your_challenger 4y agoNew Vector (the company behind Element) is building tools on the matrix protocol. And making a business out of it. Which is good. It shows the world tools that can be built on the matrix protocol. More people get involved and newer tools emerge.
- tommiegannert 4y ago+1 for sustainable open source development. I think I've seen three paths: 1. The employee who has the blessing of the company to work on a side project during some work hours. 2. The developer who does contracting to keep a passion project afloat. 3. The developers who organize a company and try to invent business cases while keeping the core free and open. Out of these, I feel (3) has the most possibilities. E.g. ability to focus, or if you happen to stumble on a great contributor, you can offer them a job. I don't see how this could be worse than the alternatives.
- jfkimmes 4y agoAs far as I can see, they "embraced" their own protocol and now "extend" it by building open source products on top[1]. Would love to see Microsoft do that kind of "extend". :) [1] https://github.com/vector-im/chatterbox https://github.com/vector-im/chatterbox
- upofadown 4y agoHow do you verify that you are actually chatting with the entity that you want to be chatting with?
- hda2 4y agoThis is very interesting. Does Chatterbox require agents to use specialized matrix clients to interact with customers or will any matrix client do? (e.g Element for android) If any matrix element would do, how will new customers appear in the client? Will they pop up as a new direct chat?
- RMidhunSuresh 4y agoYou can use any matrix client to interact with the customers. New customers will appear as direct chats in your preferred client.
- sylvain_kerkour 4y agoWhile I like the idea, I feel the that this announce is wrong. First the pricing is outrageously high. Second, why not provide a link to try it? And screenshots to see how it looks from an agent's point of view. Because Most embedded chat widgets come with advanced customer support features, and Element applications are not designed for that. Don't tell, show!
- chrismorgan 4y ago> It’s a surprise to most people that the majority of embedded chat is not end-to-end encrypted (E2EE). I don’t know about the general populace, but I would instead be surprised to encounter E2EE in embedded chat. I also go to what I keep on saying in cases like this: first-party end-to-end encryption is broken by design. To have any semblance of real security, you need to self-host the client software, preferably also obtaining it from a different party from the transport provider. Self-hosting of the entire chat system is the only truly dependable solution here, and in that context for this application, end-to-end encryption adds no value at all, being equivalent to transport encryption.