Matrix

3974 readers

39 users here now

An open network for secure, decentralized communication

founded 6 years ago

MODERATORS

k_o_t@lemmy.ml

Matrix Metadata Problem: the server sees everything except your messages (dfrws.org)

submitted 19 hours ago* (last edited 40 minutes ago) by verifytheposter@leminal.space to c/matrix@lemmy.ml

14 comments fedilink hide all child comments

Matrix Metadata Problem: the server sees everything except your messages

People pick Matrix because of end-to-end encryption. But E2EE only protects message content — everything around it is plaintext.

The server sees:

Your ID, IP, client type and version, device you use
Your presence, typing status, read receipts
Which rooms you join and when you join/leave
Who else is in those rooms → your entire social graph
Room names, topics, avatars (all plaintext state)
For every message: who sent it, which room, a millisecond timestamp, type, size

And federation copies most of that to every other server whose users are in the room. Your "social footprint" isn't one copy — it's as many as there are servers.

you are viewing a single comment's thread
view the rest of the comments

[–] verifytheposter@leminal.space 1 points 5 hours ago (1 children)

It's already a problem that it sends the client's version, device details, avatar, and bio at all. Those device details are transmitted during federation along with everything else.

https://spec.matrix.org/latest/server-server-api

[–] stratself 1 points 1 hour ago (1 children)

Again in the linked Server-Server API, I can only find mentions of device details here. The most that is required is an opaque device ID, which alone cannot infer more device details. device_display_name is fully optional and hasn't been sent by servers for ages.

These device updates are used for sending device keys, which is needed for establishing multi-device E2EE sessions. The same kind of ratchet-based E2EE that Signal utilizes. The paper you linked only investigated a single server, non-federated deployment, extrapolating every finding to federation just doesn't make any sense.

[–] verifytheposter@leminal.space 1 points 40 minutes ago

device_display_name is optional in the federation response. Current Synapse omits it by default, but it can still be sent when explicitly enabled. Older Synapse versions also exposed it through some federation paths.

I believe you are saying that my statement, “Federation copies all of that,” is incorrect. I agree. I should have said, “Federation copies most of that.”

However, the main concern remains: a homeserver can still collect the client type and version, the device being used, room names, topics, avatars, and other metadata. Much of this information is not necessary for delivering end-to-end encrypted messages, and its collection is concerning in itself.