Element raises $30M to boost Matrix

Re:Element raises $30M to boost Matrix by easygenes on Tuesday July 27, 2021 @10:12AM (#27972680)

I think those "phonehome stats" are exactly what most people are up in arms about. Particularly the exhaustive non-depersonalized nature of them. [0]

It appears that the data which is collected includes [1]:

    Message senders
      Message senders are never encrypted
    Session/device IDs
      Due to Matrix's design, encrypting this would break verification
    Message timestamps
      It's impossible to prevent timestamps from leaking, since the server can simply note when an event is received anyway
    Room members (join/leave/invite events)
      Join/leave/invite and other room events are never encrypted
    Message edit events
      While contents are not leaked, an attacker can know when messages are edited
    Message reactions
      Reactions are never encrypted
    Read receipts
      Read receipts are never encrypted
    Nicknames
      Nicknames are never encrypted
    Profile pictures
      Profile pictures are never encrypted

Put another way [2]:

  The Matrix ID of users, usually including their username.
  Email addresses, phone numbers of the user and their contacts.
  Associations of Email, phone numbers with Matrix IDs.
  Usage patterns of the user.
  IP address of the user, which can give more or less precise geographical location information.
  The user’s devices and system information.
  The other servers that users talks to.
  Room IDs, potentially identifying the Direct chat ones and the other user/server.

[0] <https://www.hackea.org/notas/matrix.html>

[1] <https://serpentsec.1337.cx/matrix>

[2] <https://www.hackea.org/notas/matrix.html#facing-the-real-and...>

[ Parent | on HN ]

Re:Element raises $30M to boost Matrix by Arathorn on Tuesday July 27, 2021 @10:36AM (#27972942)

no, the "phonehome stats" i was referring to are the opt-in anonymous aggregated usage stats that synapse provides: https://github.com/matrix-org/synapse/blob/master/synapse/ap... etc.

All the stuff you enumerate is metadata that your server stores in order to store your conversations. Until P2P Matrix lands, if you're worried about metadata, only talk to people on servers whose admins you trust.

[ Parent | on HN ]

Re:Element raises $30M to boost Matrix by easygenes on Tuesday July 27, 2021 @11:15AM (#27973436)

Thanks for the clarification.

Congrats on your round. Best wishes for turning that into a robust truly decentralized E2EE communications platform that the average person won't shy from. Btw, I hope SNEK sticks!

[ Parent | on HN ]

Re:Element raises $30M to boost Matrix by Arathorn on Tuesday July 27, 2021 @01:40PM (#27975248)

Thanks :) Also, another improvement to protect metadata that we're working on is https://github.com/matrix-org/matrix-doc/blob/rav/proposal/r... (and relatedly https://github.com/matrix-org/matrix-doc/blob/neilalexander/...). By giving each sender in a given room its own public key, you can de-correlate the identities between rooms by blowing away the mapping that links a matrix ID to an identity in a given room. (Of course, a malicious actor could deliberately monitor this and de-de-correlate - to which P2P is the longer term solution.)

[ Parent | on HN ]

Re:Element raises $30M to boost Matrix by easygenes on Wednesday July 28, 2021 @09:31AM (#27983490)

Oh yes, great. I was wondering yesterday if you'd looked at an approach like this, but hadn't gotten to looking at docs/code. Thanks for the pointers! It's definitely a good start for obfuscation.

[ Parent | on HN ]

Re:Element raises $30M to boost Matrix by kitkat_new on Tuesday July 27, 2021 @11:11AM (#27973375)

> Associations of Email, phone numbers with Matrix IDs.

Collected hashed at a identity server (you can choose) in case you decide that other people should be able to use the identity server to discover you via phone number

[ Parent | on HN ]