Matrix

416 readers

17 users here now

The secure messaging protocol.

founded 2 years ago

MODERATORS

vexomet@programming.dev

Sunshine@programming.dev

Sunshine@piefed.ca

-1

Matrix Metadata Problem: the server sees everything except your messages (dfrws.org)

submitted 1 day ago* (last edited 1 day ago) by verifytheposter@leminal.space to c/matrix@programming.dev

9 comments fedilink hide all child comments

Matrix Metadata Problem: the server sees everything except your messages

People pick Matrix because of end-to-end encryption. But E2EE only protects message content — everything around it is plaintext.

The server sees:

Your ID, IP, client type and version, device you use
Your presence, typing status, read receipts
Which rooms you join and when you join/leave
Who else is in those rooms → your entire social graph
Room names, topics, avatars (all plaintext state)
For every message: who sent it, which room, a millisecond timestamp, type, size

And federation copies all of that to every other server whose users are in the room. Your "social footprint" isn't one copy — it's as many as there are servers.

you are viewing a single comment's thread
view the rest of the comments

[–] JadedBlueEyes@programming.dev 10 points 1 day ago (1 children)

This paper seems to be filled with mistakes and generally stating the obvious for anyone passingly familiar with the protocol and server administration in general.

Even figure 2 / paragraph 2 is incorrect, the cross-signing keys aren't derived, they're encrypted by the master key, which is the only derived key. Then there's stuff like using effectively deprecated database setups and client apps, not disabling debug logs, and so on.

I would not put this as recommended reading lol

[–] unexposedhazard@discuss.tchncs.de 4 points 22 hours ago* (last edited 22 hours ago) (1 children)

There are plenty of valid criticisms of the matrix protocol but people keep stumbling over their own feet when trying to make a hit piece like this simply because they don't know what they're talking about.

If you don't want any server to see anything about you then don't use other people's servers and use P2P messaging instead.

[–] WhyJiffie@sh.itjust.works 2 points 19 hours ago

If you don't want any server to see anything about you then don't use other people's servers and use P2P messaging instead.

tbh matrix could do more, but hopefully we will get to it sometime. the devs have shown interest in figuring that out.