3 ms·

I thought Matrix homeservers had access to way more metadata than Signal. Is it better than what I thought?

by jraph 4y ago

mlatu 4y ago
you can easily run your own. though you will need lotsa RAM for federation if you use synapse (mine keeps bogging down now after a year of mild use (could also be a bug idk, it allocates all the RAM and then nothing goes), now im waiting for the new server software dendrite to be able to migrate from synapse... allthough i wouldnt lose much if i just nuked the synapse instance)
- jraph 4y ago
  > you can easily run your own. Yes, and I have in the past. But that does not solve the issue completely. If the police asks me some information about one of my contacts, I'll have some metadata stored in my homeserver, and I'll need to hand it over. And vice versa. It's better that the server does not have access to this information at all in the first place.
cfhhgtyg 4y ago
What does it matter to additionally leak relationships between nessages, such as deletes or replies? Most important is who when with who which both leak to the server operators
- jraph 4y ago
  Not at all like Signal. They only have your account creation time and your last connection time https://signal.org/blog/looking-back-as-the-world-moves-forward/ https://signal.org/blog/looking-back-as-the-world-moves-forw... (edit: answering to your initial message, that said that Signal operators also have access to the same metadata, but I guess my comment still answers your sentence "Most important is who when with who which both leak to the server operators" - Signal operators have showed they can't provide this information)
  - cfhhgtyg 4y ago
    If you don't store that data or delete it, you can't provide it. But Signal could store that data because they have access to that dats
    - jraph 4y ago
      > If you don't store that data or delete it, you can't provide it. Can I do this easily and still have my homeserver work correctly with Matrix? Anyway, the law would probably require any operator to keep this data for a while since they have access to it. And I can't rely on my contact's homeservers to delete this data even if they can (technically and legally).
      - cfhhgtyg 4y ago
        Signal certeinly can store it, because they have access to it. They have access to that data alone through the fact that they are in control of their servers and, thus, can see who sends and receives messages.
        jraph 4y ago
        But they can't. That's the thing. https://signal.org/blog/sealed-sender/ https://signal.org/blog/sealed-sender/
        cfhhgtyg 4y ago
        They can. Even on a theoretical level their sealed sender technique doesn't work: https://www.ndss-symposium.org/ndss-paper/improving-signals-sealed-sender/ https://www.ndss-symposium.org/ndss-paper/improving-signals-... Now, include lower level technical Details such as the IP layer. 1. Imagine you connect to a server to send a message. Now, you send a message to someone else. The server can't see who you are, right? Because the letter misses your name. Imagine someone else sends a message to you. 2. Imagine you to connect to the same server to receive messages that the server stored for delivery with your name on it. The server gives you the messages. Do you notice something?

I thought Matrix homeservers had access to way more metadata than Signal. Is it better than what I thought?

by jraph 4y ago

I thought Matrix homeservers had access to way more metadata than Signal. Is it better than what I thought?

you can easily run your own. though you will need lotsa RAM for federation if you use synapse (mine keeps bogging down now after a year of mild use (could also be a bug idk, it allocates all the RAM and then nothing goes), now im waiting for the new server software dendrite to be able to migrate from synapse... allthough i wouldnt lose much if i just nuked the synapse instance)

jraph 4y ago
> you can easily run your own. Yes, and I have in the past. But that does not solve the issue completely. If the police asks me some information about one of my contacts, I'll have some metadata stored in my homeserver, and I'll need to hand it over. And vice versa. It's better that the server does not have access to this information at all in the first place.

cfhhgtyg 4y ago

What does it matter to additionally leak relationships between nessages, such as deletes or replies? Most important is who when with who which both leak to the server operators

jraph 4y ago
Not at all like Signal. They only have your account creation time and your last connection time https://signal.org/blog/looking-back-as-the-world-moves-forward/ https://signal.org/blog/looking-back-as-the-world-moves-forw... (edit: answering to your initial message, that said that Signal operators also have access to the same metadata, but I guess my comment still answers your sentence "Most important is who when with who which both leak to the server operators" - Signal operators have showed they can't provide this information)
- cfhhgtyg 4y ago
  If you don't store that data or delete it, you can't provide it. But Signal could store that data because they have access to that dats
  - jraph 4y ago
    > If you don't store that data or delete it, you can't provide it. Can I do this easily and still have my homeserver work correctly with Matrix? Anyway, the law would probably require any operator to keep this data for a while since they have access to it. And I can't rely on my contact's homeservers to delete this data even if they can (technically and legally).
    - cfhhgtyg 4y ago
      Signal certeinly can store it, because they have access to it. They have access to that data alone through the fact that they are in control of their servers and, thus, can see who sends and receives messages.
      - jraph 4y ago
        But they can't. That's the thing. https://signal.org/blog/sealed-sender/ https://signal.org/blog/sealed-sender/
        cfhhgtyg 4y ago
        They can. Even on a theoretical level their sealed sender technique doesn't work: https://www.ndss-symposium.org/ndss-paper/improving-signals-sealed-sender/ https://www.ndss-symposium.org/ndss-paper/improving-signals-... Now, include lower level technical Details such as the IP layer. 1. Imagine you connect to a server to send a message. Now, you send a message to someone else. The server can't see who you are, right? Because the letter misses your name. Imagine someone else sends a message to you. 2. Imagine you to connect to the same server to receive messages that the server stored for delivery with your name on it. The server gives you the messages. Do you notice something?