Privacy

31982 readers

502 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
Don't promote proprietary software
Try to keep things on topic
If you have a question, please try searching for previous discussions, maybe it has already been answered
Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
Be nice :)

Related communities

Chat rooms

[Matrix/Element]Dead
Discord

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago

MODERATORS

129

How does using Matrix compare with using Signal, privacy-wise? (lemmy.world)

submitted 1 year ago* (last edited 1 year ago) by Kalcifer@lemmy.world to c/privacy@lemmy.ml

70 comments fedilink hide all child comments

I'm not sure if it is entirely accurate to compare them in this way, as "Matrix" refers to simply the protocol, whereas "Signal" could refer to the applications, server, and protocol. That being said, is there any fundamental difference in how the Matrix ecosystem of federated servers, and independently developed applications compares to that of Signal that would make it less secure, overall, to use?

The most obvious security vulnerability that I can think of is that the person you are communicating with (or, conceivably, oneself, as well) is using an insecure/compromised application that may be leaking information. I would assume that the underlying encryption of the data is rather trustworthy, and the added censorship resistance of federating the servers is a big plus. However, I do wonder if there are any issues with extra metadata generation, or usage tracking that could be seen as an opsec vulnerability for an individual. Signal, somewhat famously, when subpoenaed to hand over data, can only hand over the date that the account was created, and the last time it was used. What would happen if the authorities go after a Matrix user? What information about that user would they be able to gather?

you are viewing a single comment's thread
view the rest of the comments

[–] TWeaK@lemm.ee 19 points 1 year ago (1 children)

Signal, somewhat famously, when subpoenaed to hand over data, can only hand over the date that the account was created, and the last time it was used.

That's old news really. Signal is subject to the laws of whatever country they operate in. As such, a country can compel them to start logging information, and they must comply.

This is what happened with ProtonMail with a protestor in France/Switzerland. I forget which way round it was, I think they were protesting in France but went back to Switzerland, then because of an agreement between France and Switzerland and because it was a crime in both countries the Swizz government was able to compel ProtonMail to start tracking their IP addresses and used this to locate and arrest the protestor.

They most likely can't compel Signal to give them the messaging data. If they did, this would require a new key exchange, which they could MITM, but this should issue a notification to both users. It's possible a government could compel them to do this silently, however this would require app updates and I'd hope this would be where Signal draw the line. However ultimately there's no way of telling if the US haven't already done this.

Open Source ftw. Matrix is far better than Signal in this regard, in fact I rate Threema over Signal, although it's only slightly better.

[–] Lichtblitz@discuss.tchncs.de 5 points 1 year ago (2 children)

Threema is very security focused at the expense of user experience. You lost your private key? Tough luck, here's a new account and everyone will have to verify your new account again. I have had conversations with friends over five or six of their accounts because they use threema just like WhatsApp. I stopped recommending threema to folks without a basic technical understanding. Signal is more than good enough for their needs.

[–] TWeaK@lemm.ee 3 points 1 year ago

Lol and here's me running a rolling backup with everything in it. Haven't had to redo it ever really.

The only thing is it's a paid app. Although, I don't mind buying licenses for people I want to talk to.