Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

element.io

Post reply on HN
Print view View original

231–240 of 422 posts

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#231

Post by pkulak »

tao_oat wrote: post #97

> It’s also worth noting that end-to-end encryption is necessarily broken as messages to (and from) WhatsApp, Signal and Telegram pass across the bridge(s). The bridge(s) operates in Element’s trusted EMS environment, with no content scanning or datamining, but currently bridged conversations are not stored end-to-end encrypted in Matrix (they will be in the future). As a Signal user, I kind of don't want this to tak…

> I like knowing that when I message someone on Signal, it's for their eyes only.

That's not how it works at all. E2E encryption only guarantees that your message is securely delivered to the other party, not that the other party can't do as they please with it. Signal messages are still stored in plain text on the end devices. They can still be backed up to the cloud (when I used Signal, all my chats were). Hell, photos/screenshots can still be taken of the app. If you want total security, you have to trust the delivery AND the end user. Bridging doesn't really change any of that.

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#232

Post by godelski »

phicoh wrote: post #222
TheRealPomax wrote: post #171

Earlier quoted context omitted.

Because your own service is not an alternative if you actually need to secure-message others because of the line of work you're in, or the regime you're under. The idea that "just do it yourself" is more secure than a company that can't just be walked into and have their computers taken without it causing a huge problem for everyone from your mom to heads of state is a bit naive.

The advantage of having your servers at home is that when the police shows up with a search warrent you know you can't trust that server anymore. If you use a 3rd party, it can be compromised and you only find out when it is too late.

I'm pretty sure my server at home is less secure since I'm not a professional security expert. I can recognize that I'm dumb and going to make a lot of mistakes.

The disadvantage of having your server at your home is that you don't know if it's compromised from day one. I may never even find out and just fool myself the entire time.

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#233

Post by _red »

KAMSPioneer wrote: post #141
Arathorn wrote: post #125

Earlier quoted context omitted.

(Element CEO here). Honestly, it depends on your threat profile. Any kind of bridge has to inevitably MITM your conversations in order to work, and we’ve tried to spell that out in all the product info about Element One. If you want to avoid your E2EE conversations on Signal or WhatsApp being relayed via a service like Element One (because you’re an activist or whatever), then your options are to not bridge at all, o…

That's all well and good, but I believe the original complaint was more concerning the second party in the conversation. There's no way for me, a hypothetical person who wants to keep my Signal messages 100% encrypted in the Signal ecosystem, to opt out of my contacts using an Element bridge. Sure, I can go around and tell everyone I know that they shouldn't bridge Signal to Element One because , but there's no way f…

>There's no way for me, a hypothetical person who wants to keep my Signal messages 100% encrypted in the Signal ecosystem, to opt out of my contacts using an Element bridge.

This sounds like a made-up concern.

How do you stop me from screenshotting your convo and posting on twitter, or just copying and pasting from one app to the next?

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#234

Post by acomar »

Arathorn wrote: post #125
tao_oat wrote: post #97

> It’s also worth noting that end-to-end encryption is necessarily broken as messages to (and from) WhatsApp, Signal and Telegram pass across the bridge(s). The bridge(s) operates in Element’s trusted EMS environment, with no content scanning or datamining, but currently bridged conversations are not stored end-to-end encrypted in Matrix (they will be in the future). As a Signal user, I kind of don't want this to tak…

(Element CEO here). Honestly, it depends on your threat profile. Any kind of bridge has to inevitably MITM your conversations in order to work, and we’ve tried to spell that out in all the product info about Element One. If you want to avoid your E2EE conversations on Signal or WhatsApp being relayed via a service like Element One (because you’re an activist or whatever), then your options are to not bridge at all, o…

because "trust us" has such a great track record.

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#235

Post by monkeywork »

asymmetric wrote: post #154
Arathorn wrote: post #125

Earlier quoted context omitted.

(Element CEO here). Honestly, it depends on your threat profile. Any kind of bridge has to inevitably MITM your conversations in order to work, and we’ve tried to spell that out in all the product info about Element One. If you want to avoid your E2EE conversations on Signal or WhatsApp being relayed via a service like Element One (because you’re an activist or whatever), then your options are to not bridge at all, o…

> TL;DR: if you don’t trust Element with your Signal conversations for whatever reason, don’t hook up Signal to your Element One account :) AFAIU GP’s point was that even if I don’t bridge, the recipient of the message might, thereby diluting the trust all users have in E2E on Signal, since you can’t know who’s bridging and who isn’t.

That has always been the case no? You can't know what the person you are sending the message to is doing with it, the status of their device, or anything else.

I fail to see anything that Element is doing "wrong" here, the issues you are describing are issues between you and your conversation partner

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#237

Post by jeltz »

topdancing wrote: post #193
comice wrote: post #189

Earlier quoted context omitted.

> for encryption fans, I've been wondering for a long time now: why would you trust ANY 3rd party with your so sensitive data instead of running your own service? Are you not aware of OMEMO for XMPP? we ran our own XMPP server for over 10 years using the "off the record" plugin for end to end encryption. Development seem to basically stop on open chat clients a few years ago and everything started getting crufty. (I…

For the past two years; I've been using Conversations (Android), Dino (Linux), and friends of mine have been using Gajim (Windows), Monal/Siskin (iOS). All of these work fine with OMEMO (the iOS ones gained better OMEMO and push support in the past few months) and message history retrieval between clients. Gajim doesn't do inline images, but the rest do. I occasionally use profanity as a console client and that recen…

Maybe not developers in general, but development of Pidgin certainly stalled, which is why I stopped using it. Too man features not implrmnted in XMPP and no working support for e.g. Skype.

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#238

Post by jeltz »

noirbot wrote: post #176
pmlnr wrote: post #137

Earlier quoted context omitted.

No, this is not the same. You want the utmost privacy, yet you still decide to trust someone over it.

I don't want "the utmost privacy". I want something better than raw SMS. I'm not an international secret agent. I encrypt things out of principal more than because I really care if some government force reads them. If a nation-state decides I'm of interest to them for malicious reasons, I'm probably screwed either way.

Then these bridges are fine. Virtually everything is better than raw SMS.

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#239

Post by a-dub »

this has been around since at least january of 2021.

i looked into using something like this or setting up my own synapse+bridges and ultimately thought the synapse server had way too much in the way of complexity and attack surface for something that would ultimately end up being a consolidation of all my encrypted messaging. (it was also a bit weird to see public internet protocols using grpc, but i guess that's what people do now)

that's the world we live in i guess. you either dedicate a bunch of time to watching your own infra, let tech giants read your messages or let hackers read your messages.

this is fine.

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#240

Post by 5- »

> hosted by Element Matrix Services; constantly maintained to the highest standard and best practices by the experts who created Matrix - giving an infinitely better experience than the typical free-for-all of public homeservers.

so much for the federation.

Post reply on HN