XMPP: Admin-in-the-middle

Re:XMPP: Admin-in-the-middle by southerntofu on Thursday November 04, 2021 @05:40AM (#29105088)

In matrix, not only can your homeserver usually impersonate you, but most information/history in rooms is considered public and archived forever. I haven't followed recently if there were mitigations on this topic, but that was historically one of the reasons many activists stuck with IRC/XMPP who support ephemeral discussions and/or an explicit data retention policies (eg. keep the latest 20 messages in this room so newcomers can have a little backlog).

In case that wasn't clear, in the XMPP model, the backlog for a room is kept on the room's server, not on every individual home server. In matrix, all data is replicated on all servers (which eats massive server resources, although newer implementations like conduit seem to improve on that) which greatly increases the possibilities for a bad actor to find their way to these conversations.

[ Parent | on HN ]

Re:XMPP: Admin-in-the-middle by gefhfff on Thursday November 04, 2021 @08:00AM (#29106016)

> who support ephemeral discussions and/or an explicit data retention policies

Matrix's variant of that: https://brendan.abolivier.bzh/matrix-retention-policies/

> In case that wasn't clear, in the XMPP model, the backlog for a room is kept on the room's server, not on every individual home server. In

Which makes your history dependent on a plethora of different servers. Result: very bad usability

> replicated on all servers

No, this is misleading. It is replicated between servers that have users participating in the conversation, i.e. know the conversation anyways

> which eats massive server resources

I'd like to have a source for that. To my knowledge Matrix cryptographically verifying actions between servers (prohibiting various bad actions due to the decentralized nature of rooms in Matrix) and the implied DAG is really what needs resources

[ Parent | on HN ]