9 ms·

Matrix.org Will Migrate to MAS

198 points by LorenDB 2y ago

apetresc 2y ago
I vaguely remember an old MSC or TWIM or something that described (the possibility of) a new authentication mechanism whereby I could set up either a dummy homeserver or something in .well_known that would allow me to use my own domain but without needing to use my own homeserver for the actual traffic. Sort of like an auth-only homeserver, if you will. Is that part of MAS? Was that initiative ever fully-baked? Or am I just misremembering?
- MartijnBraam 2y ago
  Afaik that's not related to this, that was already possible as a domain alias. I think that feature is called a delegation if I remember correctly.
- Arathorn 2y ago
  That's .well-known based delegation, which was proposed in MSC1708 in Nov 2017: https://github.com/matrix-org/matrix-spec-proposals/blob/old_master/proposals/1708-well-known-for-federation.md https://github.com/matrix-org/matrix-spec-proposals/blob/old... and merged into the spec in Jan 2019 (prior to Matrix 1.0 in June 2019): https://github.com/matrix-org/matrix-spec/commit/0347e873efca4f80460492bdff9271601c7bc341 https://github.com/matrix-org/matrix-spec/commit/0347e873efc... So yes, fully-baked and part of Matrix since 1.0! Next Gen Auth via OIDC is instead a key part of the (upcoming) Matrix 2.0 spec release - see https://areweoidcyet.com https://areweoidcyet.com and https://github.com/matrix-org/matrix-spec-proposals/pull/3861 https://github.com/matrix-org/matrix-spec-proposals/pull/386...
jckahn 2y ago
Cool! I’ve recently consolidated all of my Google Chat and WhatsApp friends onto Matrix (via Element) because it’s E2EE. Gchat isn’t and I assume that Meta has a backdoor into WhatsApp conversations. So, those platforms can’t be trusted. Signal doesn’t have a web interface, so that’s a no-go for me. lol Telegram. Matrix has been great for me and I recommend that everyone else use it!
- Steltek 2y ago
  Self-hosted Matrix with all the bridges is awesome and brings back that Pidgin/Adium life of one chat app for all of my friends. Too bad Apple has an uncanny ability to avoid consequences with iMessage.
  - nisa 2y ago
    It's wonderful that it seems work well for you but my experience in bridging group chats with XMPP or IRC was terrible. Lost messages, bridge crashes, puppet accounts getting randomly broken/duplicated with discarded messages. From the bridges I've run, only the Telegram bridge is somewhat stable for me but it also has it's warts. Might be different if you run a strictly personal server for 1:1 conversations but I'd say from an ux perspective the bridges idea largely failed IMHO. I don't think it's the fault of element/matrix it's a difficult problem and I guess with limited resources they made a lot of progress and made things possible that weren't before but it's not plug and play, at least it wasn't for me. In general I've found it's also difficult to communicate in group chats if there are two worlds with a slightly different view (missing reactions, some elements of the messenger are not supported like captions, polls and so on...)
    - kuon 2y ago
      While I generally agree, the slidge bridge for XMPP has been working quite well for me, especially whatsapp, but it is really new.
      - nisa 2y ago
        > slidge bridge Didn't knew about this one. Thanks I'm looking into it!
- VladVladikoff 2y ago
  >lol Telegram Did I miss something? what's wrong with telegram?
  - 2y ago
deleted 2y ago
[deleted]
jokoon 2y ago
I set firefox to clear cookies, also using cookies to "strict" This somehow causes a huge pain to connect to mozilla's matrix instance, and I never understood why. This is a bit ironic since firefox has that feature to clear cookies. I had to reset password, and do other weird things, I can't remember what exactly. I hope this MAS thing fixes it.
- apples_oranges 2y ago
  So unusable for people like me who only surf in private mode
- anon7000 2y ago
  I mean, yeah, tracking prevention features basically completely break cross-domain authentication. There are a surprising number of valid use cases that need cross-domain auth (or make the user experience a lot easier). While there are workarounds these days, sometimes it does require deep changes in how auth works
  - jokoon 2y ago
    > There are a surprising number of valid use cases that need cross-domain auth I am not a web developer, but I would disagree with that. Either web standards respect privacy or they don't, but I would not sacrifice privacy for anything. Firefox was right to prevent tracking, it highlights how webstandards are just not good. I something doesn't work properly in a firefox private window, to me it should not exist.
    - kibwen 2y ago
      The status quo appears to involve handing over your account password to your chosen client. That's worse than this.
      - wkat4242 2y ago
        If you don't trust your matrix client, why use it at all? It's also a bit disheartening to see Matrix putting all that "Log in with Google", Apple, Facebook etc so prominently on their login page. The whole idea of decentralised services was getting out of those walled gardens.
BrenBarn 2y ago
> No more typing your password in every client you’d like to log in to. So. . . how will we log in? This post is heavy on vague promises of greatness but light on concrete details of UX.
- halJordan 2y ago
  Read the whole blog, and it directs you further for more details. But this blog does tell you they're moving to oidc. That means you will get all the non password flows oidc supports. This is a reading comprehension problem more than a blog writing problem
- palata 2y ago
  > So. . . how will we log in? I think you will log into your server, and then the server will offer you to give access to the client. The screenshot right below the line you quote seems to show exactly that.
  - BrenBarn 2y ago
    I guess I can believe that, but it's unclear because there's nothing to tell me what that's a screenshot of. The icon in the screenshot is the Element icon, which is a client, so at first glance I figure it's a screenshot of Element. After reading your comment I can infer that it's actually something else (a website?) showing me the icon of the client that wants access. That makes sense, but it's not obvious just from the screenshot. One reason I ask about this is I always wonder how it will work for someone writing their own client, perhaps a very basic client (or a bot). Any answer that involves "you will click on X" doesn't apply there. As long as there's a straightforward API based way, that's cool. And I assume there is one here. But my experience has been that such changes aimed at "greater security" often make things more cumbersome for small-time developers. But we'll see. Certainly a smoother login (and logout!) experience for Matrix would be welcome so hopefully this will be a plus overall.
    - magicalhippo 2y ago
      The blog mentions right at the start that it's based on OAuth 2.0/OIDC, similar to how you log in to your Google account in Thunderbird for example. > I always wonder how it will work for someone writing their own client, perhaps a very basic client (or a bot). For interactive clients, it'll be the standard OAuth 2.0 Authorization Code flow[1]. For non-interactive services they say in the proposal[2] that one uses the existing method but they will implement the standard OAuth 2.0 Client Credentials flow[3], which is effectively like a traditional username/password deal, though the "password" is not the account password. [1]: https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow https://learn.microsoft.com/en-us/entra/identity-platform/v2... [2]: https://github.com/matrix-org/matrix-spec-proposals/blob/0023db90aca5e1e55cc6da0848337e2c3a32bd19/proposals/3861-next-generation-auth.md#application-services https://github.com/matrix-org/matrix-spec-proposals/blob/002... [3]: https://developer.okta.com/docs/concepts/oauth-openid/#client-credentials-flow https://developer.okta.com/docs/concepts/oauth-openid/#clien...
neilv 2y ago
* Is all matrix.org's server-side for this open source, and able to be self-hosted? * Do all the Matrix clients need to be modified to support this authentication method?
- cyberax 2y ago
  1. Yes. Even the public website is open source. The license is AGPLv3: https://github.com/element-hq/synapse https://github.com/element-hq/synapse 2. Yes.
- Arathorn 2y ago
  The new authentication server (MAS) is at https://github.com/element-hq/matrix-authentication-service https://github.com/element-hq/matrix-authentication-service (AGPLv3) and entirely self-hostable - e.g. https://github.com/element-hq/ess-helm https://github.com/element-hq/ess-helm for the brand new official helm charts from Element, or https://github.com/element-hq/element-docker-demo https://github.com/element-hq/element-docker-demo for a very quick and dirty docker-compose setup i threw together. MAS provides backwards compatibility for the old Matrix auth APIs for existing Matrix clients, so they do not need to be modified to keep working. However, to get the most out of all the new auth features (2FA, MFA, QR login etc. etc.) then clients will need to be upgraded to speak OIDC natively. Element X for instance is already OIDC-native. https://areweoidcyet.com https://areweoidcyet.com has more details.
kibwen 2y ago
Discord's ongoing enshittification may create a market opportunity for alternatives in the near future. I'd like to think that Matrix could be a beneficiary of that, but the common-case UX needs to be polished damn well when the time comes if they want to capitalize.
- Arathorn 2y ago
  MAS and Next Gen Auth open up the way to things like QR-login (complete with syncing all E2EE state and verification!) which should help enormously with common-case UX. See https://youtu.be/ZiRYdqkzjDU?t=966 https://youtu.be/ZiRYdqkzjDU?t=966 for a demo of it from The Matrix Conference in Sept, or https://youtu.be/lkCKhP1jxdk?t=1832 https://youtu.be/lkCKhP1jxdk?t=1832 showing it working in on a fresh instance of element-docker-demo at FOSDEM 2025.
- 74848732648 2y ago
  Eh... Discord's enshittified client is still a hundred times more usable than Element — for all its faults, at least Discord is able to deliver and display messages reliably ("unable to decrypt message", anyone?). And for the more technologically oriented, client mods do a lot to improve the Discord UX. Element X is supposed to improve things, but it's stuck on Android and iOS for the foreseeable future.
  - genewitch 2y ago
    I haven't seen that message in literal years.
frankzander 2y ago
Does actually exist matrix servers for warez?
oofbey 2y ago
So Matrix is the new XMPP?
- vaylian 2y ago
  Did XMPP ever use these protocols for authentication?
  - Arathorn 2y ago
    fwiw, there's a XEP for OIDC in XMPP from last year: https://xmpp.org/extensions/xep-0493.html https://xmpp.org/extensions/xep-0493.html. ATproto is also moving to it as its primary auth mechanism: https://github.com/bluesky-social/atproto/discussions/2656 https://github.com/bluesky-social/atproto/discussions/2656.
deleted 2y ago
[deleted]
yaky 2y ago
This sounds great for large and corporate servers, but a pain for small self-hosted ones. More configuration and external dependencies. Plus additional confusion for non-techy users on those smaller servers.
- jchw 2y ago
  I don't think this will be required for other servers any time soon, if ever. Clients are going to have to support logging in the oldschool way indefinitely, especially since most Matrix servers are basically unmaintained.
  - t3chguy 2y ago
    You say that, but Element X (Android & iOS) already lacks full support for the oldschool way. It only supports certain flows therein AIUI.
    - jchw 2y ago
      Yeah, I realize that, but that's exactly why it's Element X and not Element. Element was actually planning on dropping support for older servers, but for ecosystem reasons they had to can that indefinitely. I don't think Element will become Element X anytime soon with the ecosystem in such bad shape.
      - yaky 2y ago
        Several years ago, Riot.im messenger had a branch called RiotX with some additional features. Then RiotX (or its codebase) became the first version of Element, while the original Riot.im stopped being supported. And this was when Synapse was the only server option and it was a hog for memory.
xyst 2y ago
I quickly looked at the MSCs and seems “MAS” and associated MSCs enable OIDC/OAUTH authentication flows (basically integration with your favorite identity provider such as Google or Apple). I was hoping for matrix homeserver to act as an identity provider as well to give us an alternative to big tech for “identity”. I suppose I could just setup Ory or other open source IdP, but would have been nice to have an all in one package.
- Arathorn 2y ago
  MAS can be used as an OIDC IdP, and in future MAS will be embeddable in Synapse so you can use your homeserver as an IdP in the way you want, all in one package. That said, MAS is deliberately not a very featureful IdP - it's focused on being the glue between Matrix and OIDC. If you want a more sophisticated IdP then you'll still want to run a dedicated one.
nadir_ishiguro 2y ago
Love matrix. Improving the onboarding is a great step. I've seen less technical people have issues in that area until now. Mostly a desktop/web user myself, hoping all that Element X work will trickle down to us.
sanatgersappa 2y ago
Anybody tried Simplex? - https://simplex.chat/ https://simplex.chat/
barodeur 2y ago
Congrats to Quentin and all the other contributors to this project.
spintin 2y ago
[dead]

198 points by LorenDB 2y ago

I vaguely remember an old MSC or TWIM or something that described (the possibility of) a new authentication mechanism whereby I could set up either a dummy homeserver or something in .well_known that would allow me to use my own domain but without needing to use my own homeserver for the actual traffic. Sort of like an auth-only homeserver, if you will. Is that part of MAS? Was that initiative ever fully-baked? Or am I just misremembering?

MartijnBraam 2y ago
Afaik that's not related to this, that was already possible as a domain alias. I think that feature is called a delegation if I remember correctly.
Arathorn 2y ago
That's .well-known based delegation, which was proposed in MSC1708 in Nov 2017: https://github.com/matrix-org/matrix-spec-proposals/blob/old_master/proposals/1708-well-known-for-federation.md https://github.com/matrix-org/matrix-spec-proposals/blob/old... and merged into the spec in Jan 2019 (prior to Matrix 1.0 in June 2019): https://github.com/matrix-org/matrix-spec/commit/0347e873efca4f80460492bdff9271601c7bc341 https://github.com/matrix-org/matrix-spec/commit/0347e873efc... So yes, fully-baked and part of Matrix since 1.0! Next Gen Auth via OIDC is instead a key part of the (upcoming) Matrix 2.0 spec release - see https://areweoidcyet.com https://areweoidcyet.com and https://github.com/matrix-org/matrix-spec-proposals/pull/3861 https://github.com/matrix-org/matrix-spec-proposals/pull/386...

jckahn 2y ago

Cool! I’ve recently consolidated all of my Google Chat and WhatsApp friends onto Matrix (via Element) because it’s E2EE. Gchat isn’t and I assume that Meta has a backdoor into WhatsApp conversations. So, those platforms can’t be trusted. Signal doesn’t have a web interface, so that’s a no-go for me. lol Telegram. Matrix has been great for me and I recommend that everyone else use it!

Steltek 2y ago
Self-hosted Matrix with all the bridges is awesome and brings back that Pidgin/Adium life of one chat app for all of my friends. Too bad Apple has an uncanny ability to avoid consequences with iMessage.
- nisa 2y ago
  It's wonderful that it seems work well for you but my experience in bridging group chats with XMPP or IRC was terrible. Lost messages, bridge crashes, puppet accounts getting randomly broken/duplicated with discarded messages. From the bridges I've run, only the Telegram bridge is somewhat stable for me but it also has it's warts. Might be different if you run a strictly personal server for 1:1 conversations but I'd say from an ux perspective the bridges idea largely failed IMHO. I don't think it's the fault of element/matrix it's a difficult problem and I guess with limited resources they made a lot of progress and made things possible that weren't before but it's not plug and play, at least it wasn't for me. In general I've found it's also difficult to communicate in group chats if there are two worlds with a slightly different view (missing reactions, some elements of the messenger are not supported like captions, polls and so on...)
  - kuon 2y ago
    While I generally agree, the slidge bridge for XMPP has been working quite well for me, especially whatsapp, but it is really new.
    - nisa 2y ago
      > slidge bridge Didn't knew about this one. Thanks I'm looking into it!
VladVladikoff 2y ago
>lol Telegram Did I miss something? what's wrong with telegram?
- 2y ago

deleted 2y ago

[deleted]

jokoon 2y ago

I set firefox to clear cookies, also using cookies to "strict" This somehow causes a huge pain to connect to mozilla's matrix instance, and I never understood why. This is a bit ironic since firefox has that feature to clear cookies. I had to reset password, and do other weird things, I can't remember what exactly. I hope this MAS thing fixes it.

apples_oranges 2y ago
So unusable for people like me who only surf in private mode
anon7000 2y ago
I mean, yeah, tracking prevention features basically completely break cross-domain authentication. There are a surprising number of valid use cases that need cross-domain auth (or make the user experience a lot easier). While there are workarounds these days, sometimes it does require deep changes in how auth works
- jokoon 2y ago
  > There are a surprising number of valid use cases that need cross-domain auth I am not a web developer, but I would disagree with that. Either web standards respect privacy or they don't, but I would not sacrifice privacy for anything. Firefox was right to prevent tracking, it highlights how webstandards are just not good. I something doesn't work properly in a firefox private window, to me it should not exist.
  - kibwen 2y ago
    The status quo appears to involve handing over your account password to your chosen client. That's worse than this.
    - wkat4242 2y ago
      If you don't trust your matrix client, why use it at all? It's also a bit disheartening to see Matrix putting all that "Log in with Google", Apple, Facebook etc so prominently on their login page. The whole idea of decentralised services was getting out of those walled gardens.

BrenBarn 2y ago

> No more typing your password in every client you’d like to log in to. So. . . how will we log in? This post is heavy on vague promises of greatness but light on concrete details of UX.

halJordan 2y ago
Read the whole blog, and it directs you further for more details. But this blog does tell you they're moving to oidc. That means you will get all the non password flows oidc supports. This is a reading comprehension problem more than a blog writing problem
palata 2y ago
> So. . . how will we log in? I think you will log into your server, and then the server will offer you to give access to the client. The screenshot right below the line you quote seems to show exactly that.
- BrenBarn 2y ago
  I guess I can believe that, but it's unclear because there's nothing to tell me what that's a screenshot of. The icon in the screenshot is the Element icon, which is a client, so at first glance I figure it's a screenshot of Element. After reading your comment I can infer that it's actually something else (a website?) showing me the icon of the client that wants access. That makes sense, but it's not obvious just from the screenshot. One reason I ask about this is I always wonder how it will work for someone writing their own client, perhaps a very basic client (or a bot). Any answer that involves "you will click on X" doesn't apply there. As long as there's a straightforward API based way, that's cool. And I assume there is one here. But my experience has been that such changes aimed at "greater security" often make things more cumbersome for small-time developers. But we'll see. Certainly a smoother login (and logout!) experience for Matrix would be welcome so hopefully this will be a plus overall.
  - magicalhippo 2y ago
    The blog mentions right at the start that it's based on OAuth 2.0/OIDC, similar to how you log in to your Google account in Thunderbird for example. > I always wonder how it will work for someone writing their own client, perhaps a very basic client (or a bot). For interactive clients, it'll be the standard OAuth 2.0 Authorization Code flow[1]. For non-interactive services they say in the proposal[2] that one uses the existing method but they will implement the standard OAuth 2.0 Client Credentials flow[3], which is effectively like a traditional username/password deal, though the "password" is not the account password. [1]: https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow https://learn.microsoft.com/en-us/entra/identity-platform/v2... [2]: https://github.com/matrix-org/matrix-spec-proposals/blob/0023db90aca5e1e55cc6da0848337e2c3a32bd19/proposals/3861-next-generation-auth.md#application-services https://github.com/matrix-org/matrix-spec-proposals/blob/002... [3]: https://developer.okta.com/docs/concepts/oauth-openid/#client-credentials-flow https://developer.okta.com/docs/concepts/oauth-openid/#clien...

neilv 2y ago

* Is all matrix.org's server-side for this open source, and able to be self-hosted? * Do all the Matrix clients need to be modified to support this authentication method?

cyberax 2y ago
1. Yes. Even the public website is open source. The license is AGPLv3: https://github.com/element-hq/synapse https://github.com/element-hq/synapse 2. Yes.
Arathorn 2y ago
The new authentication server (MAS) is at https://github.com/element-hq/matrix-authentication-service https://github.com/element-hq/matrix-authentication-service (AGPLv3) and entirely self-hostable - e.g. https://github.com/element-hq/ess-helm https://github.com/element-hq/ess-helm for the brand new official helm charts from Element, or https://github.com/element-hq/element-docker-demo https://github.com/element-hq/element-docker-demo for a very quick and dirty docker-compose setup i threw together. MAS provides backwards compatibility for the old Matrix auth APIs for existing Matrix clients, so they do not need to be modified to keep working. However, to get the most out of all the new auth features (2FA, MFA, QR login etc. etc.) then clients will need to be upgraded to speak OIDC natively. Element X for instance is already OIDC-native. https://areweoidcyet.com https://areweoidcyet.com has more details.

kibwen 2y ago

Discord's ongoing enshittification may create a market opportunity for alternatives in the near future. I'd like to think that Matrix could be a beneficiary of that, but the common-case UX needs to be polished damn well when the time comes if they want to capitalize.

Arathorn 2y ago
MAS and Next Gen Auth open up the way to things like QR-login (complete with syncing all E2EE state and verification!) which should help enormously with common-case UX. See https://youtu.be/ZiRYdqkzjDU?t=966 https://youtu.be/ZiRYdqkzjDU?t=966 for a demo of it from The Matrix Conference in Sept, or https://youtu.be/lkCKhP1jxdk?t=1832 https://youtu.be/lkCKhP1jxdk?t=1832 showing it working in on a fresh instance of element-docker-demo at FOSDEM 2025.
74848732648 2y ago
Eh... Discord's enshittified client is still a hundred times more usable than Element — for all its faults, at least Discord is able to deliver and display messages reliably ("unable to decrypt message", anyone?). And for the more technologically oriented, client mods do a lot to improve the Discord UX. Element X is supposed to improve things, but it's stuck on Android and iOS for the foreseeable future.
- genewitch 2y ago
  I haven't seen that message in literal years.

frankzander 2y ago

Does actually exist matrix servers for warez?

oofbey 2y ago

So Matrix is the new XMPP?

vaylian 2y ago
Did XMPP ever use these protocols for authentication?
- Arathorn 2y ago
  fwiw, there's a XEP for OIDC in XMPP from last year: https://xmpp.org/extensions/xep-0493.html https://xmpp.org/extensions/xep-0493.html. ATproto is also moving to it as its primary auth mechanism: https://github.com/bluesky-social/atproto/discussions/2656 https://github.com/bluesky-social/atproto/discussions/2656.

deleted 2y ago

[deleted]

yaky 2y ago

This sounds great for large and corporate servers, but a pain for small self-hosted ones. More configuration and external dependencies. Plus additional confusion for non-techy users on those smaller servers.

jchw 2y ago
I don't think this will be required for other servers any time soon, if ever. Clients are going to have to support logging in the oldschool way indefinitely, especially since most Matrix servers are basically unmaintained.
- t3chguy 2y ago
  You say that, but Element X (Android & iOS) already lacks full support for the oldschool way. It only supports certain flows therein AIUI.
  - jchw 2y ago
    Yeah, I realize that, but that's exactly why it's Element X and not Element. Element was actually planning on dropping support for older servers, but for ecosystem reasons they had to can that indefinitely. I don't think Element will become Element X anytime soon with the ecosystem in such bad shape.
    - yaky 2y ago
      Several years ago, Riot.im messenger had a branch called RiotX with some additional features. Then RiotX (or its codebase) became the first version of Element, while the original Riot.im stopped being supported. And this was when Synapse was the only server option and it was a hog for memory.

xyst 2y ago

I quickly looked at the MSCs and seems “MAS” and associated MSCs enable OIDC/OAUTH authentication flows (basically integration with your favorite identity provider such as Google or Apple). I was hoping for matrix homeserver to act as an identity provider as well to give us an alternative to big tech for “identity”. I suppose I could just setup Ory or other open source IdP, but would have been nice to have an all in one package.

Arathorn 2y ago
MAS can be used as an OIDC IdP, and in future MAS will be embeddable in Synapse so you can use your homeserver as an IdP in the way you want, all in one package. That said, MAS is deliberately not a very featureful IdP - it's focused on being the glue between Matrix and OIDC. If you want a more sophisticated IdP then you'll still want to run a dedicated one.

nadir_ishiguro 2y ago

Love matrix. Improving the onboarding is a great step. I've seen less technical people have issues in that area until now. Mostly a desktop/web user myself, hoping all that Element X work will trickle down to us.

sanatgersappa 2y ago

Anybody tried Simplex? - https://simplex.chat/ https://simplex.chat/

barodeur 2y ago

Congrats to Quentin and all the other contributors to this project.

spintin 2y ago

[dead]