Re:Disclosing E2EE vulnerability in multiple Matrix clients
by Arathorn on Monday September 13, 2021 @01:55PM
(#28514504)
Matrix's existing E2EE has identity verification as effectively one- or two-hop web-of-trust using QR codes or emoji comparisons. It's not impractical for users, because everyone's familiar these days with scanning a QR code as a mechanism for logging into an app (c.f. Discord, WhatsApp, Signal etc). So as long as you scan the people whose identity you care about, you're sorted, and it's much easier for normal users than the clunky old PGP signing parties of years gone by (plus it doesn't leak as much metadata, given it's just one or two hops of trust).
Re:Disclosing E2EE vulnerability in multiple Matrix clients
by brunoqc on Monday September 13, 2021 @03:06PM
(#28515404)
Can we get a arewep2pyet.org ? Maybe the wait would be more bearable ;)
Or if you prefer threats: "If I die from covid before matrix p2p is a thing, my ghost will haunt you for evar!".
Matrix P2P removes the homeservers, but clients are still talking to each other through some medium that can impersonate them.
There's really no magic solution to solve this, you need either a trusted third-party (such as Certificate Authorities, who are expensive) or a Web of Trust (impractical for users).