Tightening up Privacy in Matrix

https://matrix.org/blog/2019/06/30/tightening-up-privacy-in-matrix

by blendergeek • 7 years ago

101 36 7 years ago

matrix.org

Havoc• 7 years ago

Seems like a well thought out response

WhatIsDukkha2• 7 years ago

The addressbook, contact matching and public email are pretty low value from my perspective.

I'd much rather personally validate and match my contacts on my own and I really think this should be the default with huge WARNING to people that want to share their email globally and addressbook with the server etc.

"Users don't care" is largely because developers submarine the issues with "UX flow" reasoning.

Excusing this toxic data exfiltration with "UX" really doesn't hold water.

Edit -

Specifically looking at

https://github.com/vector-im/riot-web/issues/10167

This looks like industry standard bury the issue in unreadable TOS boilerplate.

How about "Hey YOU PROBABLY DON'T NEED to share your email globally unless you expect to meet your long lost cousin via the matrix.org social graph"

This is a place where ADDING friction makes the world better.

Arathorn10• 7 years ago

(Matrix lead here) The core problem is: empirically most users want an app which works like Signal, WhatsApp, Telegram etc and tells you which other users are contactable. If you’re some random installing a comms app, you want to know if any of your contacts are on it already. It’s nothing to do with whether your long lost cousin is on it.

However, there are then folks hyperfocused on privacy who declare this ‘toxic data exfiltration’ and vociferously object.

We’re trying to get the balance right, and it’s worth noting that the bug you linked is still up in the air. We don’t have the final UX yet, but the idea is to even more explicitly warn the user that their contacts are being uploaded to a identity lookup service if they want to discover people on the network. An alternative/complementary approach is https://github.com/vector-im/riot-web/issues/10093.

(edited due to accidentally hitting submit...)

WhatIsDukkha2• 7 years ago

Not sure I'm in the "hyperfocused on privacy" camp but I guess if people need to be typecast ok...

I use matrix to talk to a few friends and family largely trying to replace gtalk.

The irc or whatsapp usecase isn't really whats up for me.

Sharing the email globally suddenly puts its out there for 7billion other people... you KNOW this is going to get scraped and repurposed, so why do it?

Separate the flows.

1 - "Hey I'm a social butterfly and WANT to add my twitter etc I UNDERSTAND this is blasting my personal data to the world"

2 - "Hey I'd just like to get off gtalk and talk to my close friends and family/creepydarkprivacyspais"

The flows for addressbook alone... like how thought out is any of that? Oh sweet my coworkers from 17 years ago are going to matrix with me...(no thanks?).

You've done a lot of good INNOVATIVE work with matrix so far but this part seems half-baked and frankly like you are phoning it in.

DyslexicAtheist• 7 years ago

I really want to cheer for matrix/riot and this blog post moves me in that direction, but then seeing your comment as lead-dev throws me back into reality. The post is all about _tightening_ privacy! So why is the suggestion to solve addressbook feature more elegantly than a a TOS not addressed and instead GP is dismissed as being hyperfocused on privacy.

The reason I cheer about Matrix is exactly because of its P2P nature, which neither of the other privacy focused solutions like Wire/Signal address (though these give better privacy right now). Isn't it exactly the privacy conscious crowd that matrix is pitching to? Those of us who don't trust a signal or wire server because that server code is proprietary? Matrix has been promising better privacy (and e2e encryption) for some time but maybe this isn't actually where matrix is heading? I sure would like to know because there is no point for many of us to continue cheering for what otherwise looks really promising. And it's not like a better technical solution for the address book doesn't exist!!

_Codemonkeyism2• 7 years ago

I'm using Signal and I never want or wanted

"like Signal, WhatsApp, Telegram etc and tells you which other users are contactable."

jeltz• 7 years ago

you want to know if any of your contacts are on it already.

For me that is an anti-feature and something which I have so far never wanted to do. I hate when apps ask me to add users based on my other contact lists. I want to curate my contact list and only add the people I communicate with over this platform. I do not want to add a bunch of old contact's which I have forgot who they are when moving to a new messenger and I do not want to add people's accounts which they may have only used once years ago.

And this is entirely ignoring the privacy aspect of it which I do not care that much about.

meruru3• 7 years ago

most users want an app which works like Signal, WhatsApp, Telegram etc

Most users are already using Signal, WhatsApp, Telegram etc. I don't think it makes sense to sacrifice privacy to make Riot work similarly to them when the whole reason to use Riot is so that you don't have to make such sacrifices.

How does Discord works? It's pretty popular and I don't think they do that. Somehow it doesn't seem to be a problem for them.

Fnoord• 7 years ago

(edited due to accidentally hitting submit...)

You can add a value to delay in your HN profile. E.g. delay 10 gives you 10 minutes till your comment appears.

See the FAQ, "In my profile, what is delay?" [1]

[1] https://news.ycombinator.com/newsfaq.html

meruru3• 7 years ago

I'll take the chance to plug miniVector again. It doesn't solve the problems discussed in this thread, but it's a stripped-down Riot fork that requires fewer permissions than the full program: https://github.com/LiMium/mini-vector-android

I have no affiliation with the project.

larkeith• 7 years ago

Also RiotX (full rewrite of Riot Android) is hopefully landing soon, so that should improve the mobile experience a lot for people who want a full client.

maxidorius3• 7 years ago

(One of the author of the research doc that triggered this blog entry here)

It's good to finally see a reply, and it's good to see you are addressing some of the issues we have highlighted. It's a shame it took a whole research document posted on Hacker News and other websites to start getting your attention. I am personally surprised about this blog entry (and reply to some extend), given that the research doc was labeled as "FUD" by the lead dev.

Now that we have it, and that you answered in a blog post, there is one question we asked several times and that you still did not answer, even in our GDPR data request: Given that the research document clearly highlights that users are totally unaware of how their personal data was collected, how its going to be used, and that they did not given consent (e.g. storing their email addresses for a lookup query mechanism) under EU GDPR: 1. Under which lawful basis do you collect, process and allow others to use such data? 2. Are you going to keep storing/using all the data you have collected using all the methods highlighted in the research doc, or will you purge all that was collected without clear knowledge and consent of the users?

0xNippon• 7 years ago

I host my own Synapse instance and for the most part it's very reliable. I don't bridge to anything. So far it's been like pulling teeth to get my friends to sign up but once they do it's been super reliable. I'm traveling through Japan right now and the server hosted in NYC has been fine.

There are a few problems. First the UI for approving new client connections in encrypted chat rooms is complete crap. It needs to be clear and concise what is happening and currently it starts a super complicated verification process which is frankly confusing.

It simply needs to say "$user has signed in on a new device $deviceName. Is it okay to send messages to this device? Yes/No"

That's it.

Also there needs to be a better way to integrate third party plugins. One thing I miss from Facebook messenger is being able to paste a Spotify link and have the song come up as an embed.

Finally the bot API could use work. I spent some time professionally maintaining a Slack bot for a major American cable company and currently it's much harder to make a Matrix bot and documentation is lacking.

cyphar2• 7 years ago

There are a few problems. First the UI for approving new client connections in encrypted chat rooms is complete crap. It needs to be clear and concise what is happening and currently it starts a super complicated verification process which is frankly confusing.

Device cross-signing has nearly landed and will solve this problem by creating a pseudo-WoT between users meaning that you need to do verifications very infrequently (ideally, only once when you first start talking to the user).

It simply needs to say "$user has signed in on a new device $deviceName. Is it okay to send messages to this device? Yes/No"

Doing it this way would open the door to a malicious homesever (or a user's account being hacked into) being able to eavesdrop on you. Device names aren't cryptographically relevant. Device cross-signing (where a user's devices sign each other) solves the problem in a much safer way.

Finally the bot API could use work. I spent some time professionally maintaining a Slack bot for a major American cable company and currently it's much harder to make a Matrix bot and documentation is lacking.

This boils down to the fact that bots are basically just normal Matrix clients (with a few extra features if you've set them up as an application service). You might be better served by using a library (like matrix-nio or the Matrix SDKs).

rendx• 7 years ago

The feature I miss most is expiring messages. Yes, it totally depends on correct end-user client implementations and honest participants, but it is crucial for many scenarios where a client is compromised after the fact (or, lets say, an over-ambitious border control...). https://github.com/vector-im/riot-web/issues/2497

Arathorn10• 7 years ago

Hopefully this will be coming relatively soon once https://github.com/matrix-org/matrix-doc/pull/1763 is implemented. It’s mainly been waiting for someone interested in sponsoring the feature (which hasn’t happened yet).

maxidorius3• 7 years ago

Interesting that you tighten up privacy by adding more tracking to your main website with a cooking spanning sub-domains as well: https://github.com/matrix-org/matrix.org/commit/48545495afe1... and JS code from twitter directly: https://github.com/matrix-org/matrix.org/commit/30ece47f8930...

Tightening up Privacy in Matrix

Related Stories