Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

element.io

Post reply on HN
Print view View original

311–320 of 422 posts

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#311

Post by tshaddox »

superdisk wrote: post #153
Arathorn wrote: post #125

Earlier quoted context omitted.

(Element CEO here). Honestly, it depends on your threat profile. Any kind of bridge has to inevitably MITM your conversations in order to work, and we’ve tried to spell that out in all the product info about Element One. If you want to avoid your E2EE conversations on Signal or WhatsApp being relayed via a service like Element One (because you’re an activist or whatever), then your options are to not bridge at all, o…

Sure, but this defeats the entire point of Signal. You don't use it to get the maximum amount of reach to other contacts, you use it because you're confident that what you send ISN'T being MITMed... that's the entire value of the app! So unfortunately if this takes off, you never know if the reason you're even using the application is just being violated. It destroys the entire purpose. That said, I love Matrix more…

> You don't use it to get the maximum amount of reach to other contacts, you use it because you're confident that what you send ISN'T being MITMed...

Sure, but this doesn't actually introduce a new party in the middle of two Signal clients. Someone has to just decide to authorize a Signal client running on a server somewhere to receive messages from you and forward them onward outside of Signal.

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#312

Post by gnabgib »

miguelrochefort wrote: post #11
krageon wrote: post #7

Does anyone know what this product is based on? Is it just a ready-made image with all the bridges preconfigured (and prerequisites such as a small android vm for a viable whatsapp bridge), or has there been some evolution on the existing package? Is there documentation on what was done to achieve this? Purely on the content of the article: Given that the messages are not stored encrypted locally and that this servic…

> Does anyone know what this product is based on? It's very likely based on https://github.com/spantaleev/matrix-docker-ansible-deploy

It is not, according to this comment[0] "although Element One doesn’t use slavi’s ansible playbooks but instead the Element Matrix Services hosted infra"

[0]: https://news.ycombinator.com/item?id=29000978

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#313

Post by Arathorn »

colbyhub wrote: post #294
tentacleuno wrote: post #284

Earlier quoted context omitted.

Could you expand on the "privacy issues", please? Not sealioning or whatever, I am genuinely interested.

Not sure what exactly they were referring to, but here are some of them: https://github.com/libremonde-org/paper-research-privacy-mat...

sneak’s pet issue is https://github.com/vector-im/element-web/issues/11655: that element web assumes that you want to log into the matrix.org homeserver by default unless you change its config to default to a different one.

The libremonde research is over 2 years old now, and the valid bits of it were addressed at the time (https://matrix.org/blog/2019/09/27/privacy-improvements-in-s...)

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#314

Post by jcul »

hellojesus wrote: post #248
teekert wrote: post #245

Earlier quoted context omitted.

Maybe it’s not for you but more for those of us forced onto FB’s WhatsApp and their phone book scanning/uploading by social conventions. This presents a way out without giving up the benefits.

Doesn't grapheneos allow some type of sandboxing to wall off your true contacts, etc. for exactly this purpose? https://www.reddit.com/r/privacy/comments/nkyzdw/what_is_the...

Shelter can be used for this purpose if desired.

https://github.com/PeterCxy/Shelter

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#315

Post by hellojesus »

jcul wrote: post #314
hellojesus wrote: post #248

Earlier quoted context omitted.

Doesn't grapheneos allow some type of sandboxing to wall off your true contacts, etc. for exactly this purpose? https://www.reddit.com/r/privacy/comments/nkyzdw/what_is_the...

Shelter can be used for this purpose if desired. https://github.com/PeterCxy/Shelter

Thanks!

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#316

Post by wayoutthere »

2Gkashmiri wrote: post #253
noirbot wrote: post #176

Earlier quoted context omitted.

I don't want "the utmost privacy". I want something better than raw SMS. I'm not an international secret agent. I encrypt things out of principal more than because I really care if some government force reads them. If a nation-state decides I'm of interest to them for malicious reasons, I'm probably screwed either way.

remember that xkcd https://xkcd.com/538/ yeahh. thats not exactly a meme but i am personally facing these same state sponsored actions read here https://thekashmirwalla.com/not-pegasus-kashmiris-are-worrie...

Yeah, infosec has its limits. But if you’re gonna challenge the state, it does help keep things quiet until you are numerous and armed.

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#317

Post by tigroferoce »

mdavis6890 wrote: post #301
pmlnr wrote: post #137

Earlier quoted context omitted.

No, this is not the same. You want the utmost privacy, yet you still decide to trust someone over it.

I also want utmost security for my money, which is why I put it in a bank rather than holding the cash myself.

And you want utmost security for your body, which is why you go to the doctor instead of self threat. And also doctors go to other doctors when they are ill.

The sad reality is that things are complex and you probably get suboptimal results trying to do everything yourself, what other spend their lives trying to accomplish the same.

WhatsApp scaled to 1B users with only 50 engineers, but there were 50 people working full time to provide what people think they can provide in their spare time?

Also as the other end of any communication is quite scaring thinking I am communicating securely with someone, but then finding out that their server is compromised because of an out of date library or service.

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#318

Post by KAMSPioneer »

tshaddox wrote: post #309
KAMSPioneer wrote: post #263

Earlier quoted context omitted.

Those are distinct from my concern. In your scenarios, I have trusted you to keep the conversation secret, and you betrayed that trust. My concern is about giving messages in an automatic fashion to a third party, which I'm completely unaware of and have no way of making an informed decision about. The third party could be breached (they run an online service, which is much, much easier to attack than some dude's iPh…

How much do you know about your conversation partner's cyber hygiene? They might leave their phone unlocked at the library or even unknowingly install malware.

All of that is true, and remains true if they're using a bridge service as well. The bridge service is strictly reducing the security of messages.

Look, I'm not up in arms or anything, I just can immediately see a drawback to bridging Signal specifically. There exist many other services (Telegram, Slack, Discord, the list goes on) that can be bridged to Matrix without compromising the security posture in any terrificly meaningful way, IMO. So the idea is great in principle.

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#319

Post by tigroferoce »

godelski wrote: post #220
tommek4077 wrote: post #139

Earlier quoted context omitted.

That is the kind of comment that freaks me out on HACKER news.

Why? Specialization is a thing. Not everyone specializes in security. Which let's be real, being an expert in security is really difficult, especially since it's a constantly moving goal post. Unless you're an expert it's probably not a good idea to roll your own.

Also, to run your own service you must specialize in security AND devops. The two thing overlaps a bit, but not 100%. And you must hope that every contact you are talking to has the same knowledge.

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#320

Post by tshaddox »

KAMSPioneer wrote: post #318
tshaddox wrote: post #309

Earlier quoted context omitted.

How much do you know about your conversation partner's cyber hygiene? They might leave their phone unlocked at the library or even unknowingly install malware.

All of that is true, and remains true if they're using a bridge service as well. The bridge service is strictly reducing the security of messages. Look, I'm not up in arms or anything, I just can immediately see a drawback to bridging Signal specifically . There exist many other services (Telegram, Slack, Discord, the list goes on) that can be bridged to Matrix without compromising the security posture in any terrifi…

> The bridge service is strictly reducing the security of messages.

Perhaps in some sense, yes, but in precisely the same sense that you reduce the security of your messages each time you send a new message, or each time you start a conversation with a new person, or each time any of your contacts reads a message on the train where someone might be looking over their shoulder. None of these things strike me as a meaningful reduction in security, at least in the threat models that are appropriate for most average people (namely where you don't expect to be personally targeted by an attacker with resources).

Post reply on HN