129
submitted 1 year ago* (last edited 1 year ago) by Kalcifer@lemmy.world to c/privacy@lemmy.ml

I'm not sure if it is entirely accurate to compare them in this way, as "Matrix" refers to simply the protocol, whereas "Signal" could refer to the applications, server, and protocol. That being said, is there any fundamental difference in how the Matrix ecosystem of federated servers, and independently developed applications compares to that of Signal that would make it less secure, overall, to use?

The most obvious security vulnerability that I can think of is that the person you are communicating with (or, conceivably, oneself, as well) is using an insecure/compromised application that may be leaking information. I would assume that the underlying encryption of the data is rather trustworthy, and the added censorship resistance of federating the servers is a big plus. However, I do wonder if there are any issues with extra metadata generation, or usage tracking that could be seen as an opsec vulnerability for an individual. Signal, somewhat famously, when subpoenaed to hand over data, can only hand over the date that the account was created, and the last time it was used. What would happen if the authorities go after a Matrix user? What information about that user would they be able to gather?

you are viewing a single comment's thread
view the rest of the comments
[-] teolan@lemmy.world 26 points 1 year ago* (last edited 1 year ago)

Signal goes very far to protect even the tiniest bits of metadata.

For example see sealed sender, private contact discovery and group v2.

On the other hand, matrix stores your profile info, group membership, and ongoing conversation metadata in plaintext, some of them replicated across homeservers. In addition to metadata that matrix doesn't encrypt, they also do not encrypt some actual data like emoji reactions.

Edit: clarified that conversations are not in plaintext. My wording what confusing as hell sorry.

[-] booklovero@lemmy.ml 8 points 1 year ago

Matrix doesn't store your ongoing conversation in plaintext. It's encrypted by default.

[-] teolan@lemmy.world 7 points 1 year ago

What I meant by that is not the actual message content, but who you're talking to and when is stored on the home server.

[-] ono@lemmy.ca 4 points 1 year ago

your profile info,

Matrix doesn't have profiles. It has usernames, and it has avatars if you choose to upload one.

group membership

I believe this was true when I last checked. They plan to fix it.

and ongoing conversation in plaintext

That's just plain false. Please stop spreading misinformation.

[-] teolan@lemmy.world 5 points 1 year ago

Matrix doesn’t have profiles. It has usernames, and it has avatars if you choose to upload one.

That's what I call a "profile".

I believe this was true when I last checked. They plan to fix it.

Call me when it's fixed.

That’s just plain false. Please stop spreading misinformation.

Yeah my wording was incorrect, see edit.

[-] Kalcifer@lemmy.world 4 points 1 year ago* (last edited 1 year ago)
  1. Would you be able to ellaborate on the following

matrix stores your profile info

group membership

ongoing conversation in plaintext

As I am not exactly sure what you are referring to.

  1. In addition to metadata that matrix doesn’t encrypt

I'm assuming that this statement is referring to what was said here:

On the other hand, matrix stores your profile info, group membership, and ongoing conversation in plaintext, some of them replicated across homeservers

[-] teolan@lemmy.world 3 points 1 year ago

ongoing conversation in plaintext

This one is incorrect, wording was confusing as hell.

matrix stores your profile info

Profile picture and usernames are public, no way to make them private in anyway.

group membership

Your home server and the home servers of every other member of the group can tell exactly who is part of the group

ongoing conversation in plaintext

I actually meant who and when you send message to and receive messages from.

this post was submitted on 24 Jul 2023
129 points (97.1% liked)

Privacy

32103 readers
583 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS