Free and Open Source Software

22913 readers

62 users here now

If it's free and open source and it's also software, it can be discussed here. Subcommunity of Technology.

This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.

founded 4 years ago

MODERATORS

Gaywallet@beehaw.org

alyaza@beehaw.org

Matrix Metadata Problem: the server sees everything except your messages (dfrws.org)

submitted 1 day ago by verifytheposter@leminal.space to c/foss@beehaw.org

5 comments fedilink hide all child comments

Matrix Metadata Problem: the server sees everything except your messages

People pick Matrix because of end-to-end encryption. But E2EE only protects message content — everything around it is plaintext.

The server sees:

Your ID, IP, client type and version, device you use
Your presence, typing status, read receipts
Which rooms you join and when you join/leave
Who else is in those rooms → your entire social graph
Room names, topics, avatars (all plaintext state)
For every message: who sent it, which room, a millisecond timestamp, type, size

And federation copies all of that to every other server whose users are in the room. Your "social footprint" isn't one copy — it's as many as there are servers.

top 5 comments

sorted by: hot top controversial new old

[–] illusionist@lemmy.zip 8 points 22 hours ago* (last edited 22 hours ago) (1 children)

It's news from 2023. It's nice to see a formal paper covering it. It lacks a comparison to other apps to judge about it. Is it good compared to other servers that only that information is in plain text or is whatsapp better than matrix in that regard?

And does it actually matter? What is important to encrypt?

It's strange that the server shares the IP to other servers. That's not really useful for another server.

This research presents the first comprehensive forensic examination of Matrix's server-side artifacts, specifically focusing on the Synapse Homeserver implementation across 175 database tables and structured log entries.

Although much research has explored encrypted messaging apps like Signal, WhatsApp, Telegram, and iMessage, little attention has been paid to the Matrix protocol and its self-deployable server application, Synapse.

[–] Hirom@beehaw.org 7 points 22 hours ago* (last edited 1 hour ago) (1 children)

It lacks a comparison to other apps...

Yes. Would love to see this compared to XMPP, maybe Signal.

And does it actually matter? What is important to encrypt?

It matters a lot! Here's one dramatic example:

General Michael Hayden, former Director of the Central Intelligence Agency (CIA) and the NSA, confirmed after the Snowden disclosures, “We kill people based on metadata.”

Some may find this acceptable, considering the army is rightfully targetting terrorists. However the same techniques are used by autoritarian states to target political opponents, journalists, human right defenders...

It's strange that the server shares the IP to other servers. That's not really useful for another server.

Even if there's a technical reason, it shows the protocol or implementations lack good metadata protections. Hopefully the matrix foundation can fix this soon. If not, people should look for more secure options.

[–] illusionist@lemmy.zip 1 points 19 hours ago* (last edited 19 hours ago) (1 children)

It depends on your threat profile. I'm fine with that data being public on matrix - which I use for communities.

The less data is known, the better

[–] verifytheposter@leminal.space 1 points 9 hours ago (1 children)

These aren’t mutually exclusive trade-offs: Matrix could support communities while minimizing or encrypting metadata by default. There should be a protocol that doesn’t require device details and profile data to be exposed just to participate.

[–] illusionist@lemmy.zip 1 points 8 hours ago

Yes, it's good that there is a solution to the problem