4 ms·

Regular reminder Matrix/Element work closely with law-enforcement to provide encrypted comms for them. It's a sector Matrix/Element actively markets to and dea

Regular reminder Matrix/Element work closely with law-enforcement to provide encrypted comms for them. It's a sector Matrix/Element actively markets to and deals with. My personal view is I'm not using a chat platform designed/developed by an organization so eager to partner with governments and law enforcement agencies. There's Element's Chief Product Officer & Managing Director presenting at the European Police Congress[0]: https://mastodon.matrix.org/@element/110310853505977058 https://mastodon.matrix.org/@element/110310853505977058 And a quick post about their excitement at participating in this conference: https://mastodon.matrix.org/@element/110304013472307767 https://mastodon.matrix.org/@element/110304013472307767 I mean, whatever, it's just doing business, right? When someone criticized this, they gave a snarky, surprisingly unprofessional response: https://mastodon.matrix.org/@matrix/110334695988903649 https://mastodon.matrix.org/@matrix/110334695988903649 Dunno about anyone else but my trust in them is just gone. I'm not saying you have to care (and I don't care if you do). I'm sharing this for the people who do care, and don't want to use "secure messaging" made by people who actively market to and collaborate closely with law enforcement and governments. [0] https://www.european-police.eu/ https://www.european-police.eu/

__s 3y ago
What's the problem with e2e encryption for those organizations? The problem is if they give those orgs a backdoor
- amatecha 3y ago
  Oh yeah, I actually asked them about that. They said there aren't any backdoors[0]. We're all good, no worries! :) :) [0] https://mastodon.matrix.org/@element/110340953550548309 https://mastodon.matrix.org/@element/110340953550548309
  - panick21_ 3y ago
    Its open source and the crypto library is also 3rd party verified. I don't get your problem.
  - thomastjeffery 3y ago
    It's one of the most significant open source messaging systems that exist today. Anyone can audit it at any time. What more do you want?
    - amatecha 3y ago
      How do you know the matrix.org server or the element.io web client is running the same code as the source posted publicly? How exactly do you, personally, audit a hosted service? The answer to both questions is: you don't.
      - infogulch 3y ago
        So host it yourself. It's literally designed to do that.
        amatecha 3y ago
        Yeah, that's great for me, but doesn't help me when everyone else is using the hosted stuff :)
        beepbooptheory 3y ago
        Ok, I'll bite, what even could be the alternative here then? You want something without big funders, totally OSS, and extremely friendly for grandmas? Feels like one of those "you can only pick two" type things to me, but would love to learn that's not the case.
        infogulch 3y ago
        Also: 1. Mainstream enough for grandma. 2. No public hosts, you are required to self host it. Totally reasonable I don't see why this is so hard. /s
        itsanaccount 3y ago
        Its fashionable in the leftist world to compete to take the most radical position you can. You described the goal, yeah, that would be pretty wonderful, like unicorns, flying pixie dust and other things that don't seem to exist as of yet.
EGreg 3y ago
But that doesn’t mean Matrix makes backdoors. So you can use it too. What’s wrong with helping organizations including law enforcement encrypt their communications? Because they are public servants and We the Public should have ways to be able to decrypt those communications. Secret meetings and intelligence agencies are what leads to totally avoidable wars. https://community.qbix.com/t/transparency-in-government/234/2 https://community.qbix.com/t/transparency-in-government/234/...
jazzyjackson 3y ago
Fair enough to share the information but I take the opposite tack: if it's good enough for LEOs, good enough for me. I would also be excited to find paying customers when trying to build free software. In any case I get the feeling if I were to avoid technology built by companies with government contracts I would be left with my retro 8bit machines. Lets be pragmatic.
soupbowl 3y ago
I don't really see the problem here, I would prefer my local government use open standards that are secure. If they are weakening the crypto to help the police and government come after me then I would have a problem.
panick21_ 3y ago
Really strange Point of View. Governments adopting open standards rather then paying money to US tech companies is a good thing.
kevincox 3y ago
I find no issue that the company is working with law-enforcement to provide secure communications. In fact this makes me feel better about the security of those communications as they are trusted by these governments (not that this is a huge mark of quality, but I would consider it positive). I your distrust of law-enforcement so strong that any company that they purchase from must be untrustworthy? Or is there another reason that this bothers you?
- amatecha 3y ago
  My concern is in the opposite direction of what everyone appears to be interpreting, despite what I thought was clear wording in my initial post. It's not that govt/LE uses Matrix. It's that Matrix/Element actively seeks out partnership with govt/LE (to the extent of presenting on stage at a police conference), suggesting they are particularly interested in a relationship with authorities and personally sympathetic to these authorities, at the management/director level. This is not a position I expect from an organization that is determined to build secure communications potentially used by activists, people living in oppressive/authoritarian regimes, etc... If I was a member of such a high-risk group, I don't think I would be putting my faith in this org to produce something I can actually consider truly secure.
  - skeaker 3y ago
    I would guess the reason for that would be that those platforms are willing to pony up real cash and the actual communication protocol itself is no less secure when they use it. See also: Tor, famously developed/funded by the government
  - nobody9999 3y ago
    >If I was a member of such a high-risk group, I don't think I would be putting my faith in this org to produce something I can actually consider truly secure. If I were in such a high-risk group, I wouldn't be putting my "faith" in anyone. Rather, I'd personally make damn sure my sensitive communications couldn't be spied upon. I'd also point out that repressive/authoritarian regimes don't care about the rule of law and/or personal privacy, so they can just come to your house and take you away without any proof that you're working against the state. What's more, they can also confiscate any systems/devices you (or others) may have in an attempt to discover the identities of your "co-conspirators." And they can torture you to give up those names, even if the names you give up aren't actually involved at all. You seem to believe that there's some sort of magical software that can keep someone safe if a government or well-funded private actor wants to get you. News flash: there is no such animal.
nobody9999 3y ago
>Regular reminder Matrix/Element work closely with law-enforcement to provide encrypted comms for them. Thank you for the reminder. Based on that, are you claiming that Matrix servers/clients are insecure or have government back doors? If so, what evidence do you have that supports such a claim? If not, why should I care? I'm not a fan of many organizations/individuals. Should I survey them all to create a database of software those folks use and refuse to use any software they use? What value would I derive from such actions? Unless you're claiming the former (evidence please), what difference does it make? I use Matrix servers/clients only on hardware that's under my physical control. And I use free (libre and beer) versions of Matrix implementations, so I'm not even giving the developers any money. Or are you making the argument that LEOs shouldn't have access to secure communications protocols? I guess I'm confused because I don't understand what the issue might be. If you'd elucidate, I'd much appreciate it!
- amatecha 3y ago
  I didn't claim/assert anything other than what I linked to already in my original post. You don't have to care, and like I said, I don't care if you care or not. I'm just making people aware, because some people _do_ care. It's nice that you personally use matrix on hardware under your physical control. That's rare. The vast vast majority of matrix users have their account on matrix.org and are using Element. I'm glad to hear you are using alternative server and client software. I addressed the other questions at https://news.ycombinator.com/item?id=37602089 https://news.ycombinator.com/item?id=37602089
  - skeaker 3y ago
    When someone asks "why should I care," the implication is that they want to know why you care. Dodging the question here is an interesting way to respond
    - amatecha 3y ago
      People who want to work closely with authorities probably shouldn't be trusted to provide your secure communication software.
cvwright 3y ago
You are mad that they took money away from someone you don’t like? And moreover that they used this money for something that you do like?
- Smaug123 3y ago
  "Taking money" is a very poor description of a trade, which both parties chose to enter into because they both expect to derive benefit from it. What the parent objects to is presumably the "government/police/military expects to derive benefit" part, not the "taking money" part per se.

__s 3y ago

What's the problem with e2e encryption for those organizations? The problem is if they give those orgs a backdoor

amatecha 3y ago
Oh yeah, I actually asked them about that. They said there aren't any backdoors[0]. We're all good, no worries! :) :) [0] https://mastodon.matrix.org/@element/110340953550548309 https://mastodon.matrix.org/@element/110340953550548309
- panick21_ 3y ago
  Its open source and the crypto library is also 3rd party verified. I don't get your problem.
- thomastjeffery 3y ago
  It's one of the most significant open source messaging systems that exist today. Anyone can audit it at any time. What more do you want?
  - amatecha 3y ago
    How do you know the matrix.org server or the element.io web client is running the same code as the source posted publicly? How exactly do you, personally, audit a hosted service? The answer to both questions is: you don't.
    - infogulch 3y ago
      So host it yourself. It's literally designed to do that.
      - amatecha 3y ago
        Yeah, that's great for me, but doesn't help me when everyone else is using the hosted stuff :)
        beepbooptheory 3y ago
        Ok, I'll bite, what even could be the alternative here then? You want something without big funders, totally OSS, and extremely friendly for grandmas? Feels like one of those "you can only pick two" type things to me, but would love to learn that's not the case.
        infogulch 3y ago
        Also: 1. Mainstream enough for grandma. 2. No public hosts, you are required to self host it. Totally reasonable I don't see why this is so hard. /s
        itsanaccount 3y ago
        Its fashionable in the leftist world to compete to take the most radical position you can. You described the goal, yeah, that would be pretty wonderful, like unicorns, flying pixie dust and other things that don't seem to exist as of yet.

EGreg 3y ago

But that doesn’t mean Matrix makes backdoors. So you can use it too. What’s wrong with helping organizations including law enforcement encrypt their communications? Because they are public servants and We the Public should have ways to be able to decrypt those communications. Secret meetings and intelligence agencies are what leads to totally avoidable wars. https://community.qbix.com/t/transparency-in-government/234/2 https://community.qbix.com/t/transparency-in-government/234/...

jazzyjackson 3y ago

Fair enough to share the information but I take the opposite tack: if it's good enough for LEOs, good enough for me. I would also be excited to find paying customers when trying to build free software. In any case I get the feeling if I were to avoid technology built by companies with government contracts I would be left with my retro 8bit machines. Lets be pragmatic.

soupbowl 3y ago

I don't really see the problem here, I would prefer my local government use open standards that are secure. If they are weakening the crypto to help the police and government come after me then I would have a problem.

panick21_ 3y ago

Really strange Point of View. Governments adopting open standards rather then paying money to US tech companies is a good thing.

kevincox 3y ago

I find no issue that the company is working with law-enforcement to provide secure communications. In fact this makes me feel better about the security of those communications as they are trusted by these governments (not that this is a huge mark of quality, but I would consider it positive). I your distrust of law-enforcement so strong that any company that they purchase from must be untrustworthy? Or is there another reason that this bothers you?

amatecha 3y ago
My concern is in the opposite direction of what everyone appears to be interpreting, despite what I thought was clear wording in my initial post. It's not that govt/LE uses Matrix. It's that Matrix/Element actively seeks out partnership with govt/LE (to the extent of presenting on stage at a police conference), suggesting they are particularly interested in a relationship with authorities and personally sympathetic to these authorities, at the management/director level. This is not a position I expect from an organization that is determined to build secure communications potentially used by activists, people living in oppressive/authoritarian regimes, etc... If I was a member of such a high-risk group, I don't think I would be putting my faith in this org to produce something I can actually consider truly secure.
- skeaker 3y ago
  I would guess the reason for that would be that those platforms are willing to pony up real cash and the actual communication protocol itself is no less secure when they use it. See also: Tor, famously developed/funded by the government
- nobody9999 3y ago
  >If I was a member of such a high-risk group, I don't think I would be putting my faith in this org to produce something I can actually consider truly secure. If I were in such a high-risk group, I wouldn't be putting my "faith" in anyone. Rather, I'd personally make damn sure my sensitive communications couldn't be spied upon. I'd also point out that repressive/authoritarian regimes don't care about the rule of law and/or personal privacy, so they can just come to your house and take you away without any proof that you're working against the state. What's more, they can also confiscate any systems/devices you (or others) may have in an attempt to discover the identities of your "co-conspirators." And they can torture you to give up those names, even if the names you give up aren't actually involved at all. You seem to believe that there's some sort of magical software that can keep someone safe if a government or well-funded private actor wants to get you. News flash: there is no such animal.

nobody9999 3y ago

>Regular reminder Matrix/Element work closely with law-enforcement to provide encrypted comms for them. Thank you for the reminder. Based on that, are you claiming that Matrix servers/clients are insecure or have government back doors? If so, what evidence do you have that supports such a claim? If not, why should I care? I'm not a fan of many organizations/individuals. Should I survey them all to create a database of software those folks use and refuse to use any software they use? What value would I derive from such actions? Unless you're claiming the former (evidence please), what difference does it make? I use Matrix servers/clients only on hardware that's under my physical control. And I use free (libre and beer) versions of Matrix implementations, so I'm not even giving the developers any money. Or are you making the argument that LEOs shouldn't have access to secure communications protocols? I guess I'm confused because I don't understand what the issue might be. If you'd elucidate, I'd much appreciate it!

amatecha 3y ago
I didn't claim/assert anything other than what I linked to already in my original post. You don't have to care, and like I said, I don't care if you care or not. I'm just making people aware, because some people _do_ care. It's nice that you personally use matrix on hardware under your physical control. That's rare. The vast vast majority of matrix users have their account on matrix.org and are using Element. I'm glad to hear you are using alternative server and client software. I addressed the other questions at https://news.ycombinator.com/item?id=37602089 https://news.ycombinator.com/item?id=37602089
- skeaker 3y ago
  When someone asks "why should I care," the implication is that they want to know why you care. Dodging the question here is an interesting way to respond
  - amatecha 3y ago
    People who want to work closely with authorities probably shouldn't be trusted to provide your secure communication software.

cvwright 3y ago

You are mad that they took money away from someone you don’t like? And moreover that they used this money for something that you do like?

Smaug123 3y ago
"Taking money" is a very poor description of a trade, which both parties chose to enter into because they both expect to derive benefit from it. What the parent objects to is presumably the "government/police/military expects to derive benefit" part, not the "taking money" part per se.