Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

element.io

Post reply on HN
Print view View original

321–330 of 422 posts

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#321

Post by KAMSPioneer »

feanaro wrote: post #281
KAMSPioneer wrote: post #263

Earlier quoted context omitted.

Those are distinct from my concern. In your scenarios, I have trusted you to keep the conversation secret, and you betrayed that trust. My concern is about giving messages in an automatic fashion to a third party, which I'm completely unaware of and have no way of making an informed decision about. The third party could be breached (they run an online service, which is much, much easier to attack than some dude's iPh…

Just ask your conversation partner? An Element bridge is just a Signal client hosted on Element's infrastructure. Them using an Element bridge is no different than them using an extra device you didn't know about. That device could've well been insecure, or shared by many people, or hosted in the cloud. If you care about this, you should ask.

I thought I addressed that in my original comment: I _could_ go to each of my contacts and explain why I don't want them to do things like use the cool new Element service with Signal. But 1) I (finally) have a lot of contacts using Signal, so that would be a pain to manage; 2) to me, the entire idea of Signal is that I can pretty much set it and forget it on any relatively-modern smartphone for friends, family, etc. and not have to worry about anything but the biennial phone migration for my mother.

In the end it isn't a huge deal, as most conversations are extremely innocuous, and those I care about I'll take the time to verify. But after all the trouble to proselytize Signal, I get nervous about large public projects that could, in my opinion, strictly reduce the security of my secure messaging system.

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#322

Post by KAMSPioneer »

tshaddox wrote: post #320
KAMSPioneer wrote: post #318

Earlier quoted context omitted.

All of that is true, and remains true if they're using a bridge service as well. The bridge service is strictly reducing the security of messages. Look, I'm not up in arms or anything, I just can immediately see a drawback to bridging Signal specifically . There exist many other services (Telegram, Slack, Discord, the list goes on) that can be bridged to Matrix without compromising the security posture in any terrifi…

> The bridge service is strictly reducing the security of messages. Perhaps in some sense, yes, but in precisely the same sense that you reduce the security of your messages each time you send a new message, or each time you start a conversation with a new person, or each time any of your contacts reads a message on the train where someone might be looking over their shoulder. None of these things strike me as a mean…

The Matrix bridge service is compromised (their infra has been successfully attacked before, and other similar platforms have had catastrophic data breaches as well)? That doesn't require a targeted attack, involves complete history disclosure and probably far more metadata than Signal even stores on their servers.

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#323

Post by censormenow »

commoner wrote: post #194
censormenow wrote: post #27

Let's save the NSA the trouble of hacking into all our secure chat clients and just drop our authentication for everything into an app they made.

There is no evidence that Element was "made" by the NSA. Element is developed by New Vector Ltd., a UK company.

The UK is a surveillance state. They have more CCTV cameras than China.

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#324

Post by [deleted] »

tao_oat wrote: post #97

> It’s also worth noting that end-to-end encryption is necessarily broken as messages to (and from) WhatsApp, Signal and Telegram pass across the bridge(s). The bridge(s) operates in Element’s trusted EMS environment, with no content scanning or datamining, but currently bridged conversations are not stored end-to-end encrypted in Matrix (they will be in the future). As a Signal user, I kind of don't want this to tak…

[deleted]

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#325

Post by Strom »

feanaro wrote: post #281
KAMSPioneer wrote: post #263

Earlier quoted context omitted.

Those are distinct from my concern. In your scenarios, I have trusted you to keep the conversation secret, and you betrayed that trust. My concern is about giving messages in an automatic fashion to a third party, which I'm completely unaware of and have no way of making an informed decision about. The third party could be breached (they run an online service, which is much, much easier to attack than some dude's iPh…

Just ask your conversation partner? An Element bridge is just a Signal client hosted on Element's infrastructure. Them using an Element bridge is no different than them using an extra device you didn't know about. That device could've well been insecure, or shared by many people, or hosted in the cloud. If you care about this, you should ask.

> Them using an Element bridge is no different than them using an extra device you didn't know about.

It is different in a big way. That extra device would most likely only transit this one user's messages. The Element bridge transits a ton of users and as such is an attractive target for mass surveillance.

> That device could've well been [..] hosted in the cloud.

The capability of self-hosting is very niche. Only technical people could pull that off. Element is working hard to make using this bridge so easy that your grandmother could do it.

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#326

Post by tshaddox »

KAMSPioneer wrote: post #321
feanaro wrote: post #281

Earlier quoted context omitted.

Just ask your conversation partner? An Element bridge is just a Signal client hosted on Element's infrastructure. Them using an Element bridge is no different than them using an extra device you didn't know about. That device could've well been insecure, or shared by many people, or hosted in the cloud. If you care about this, you should ask.

I thought I addressed that in my original comment: I _could_ go to each of my contacts and explain why I don't want them to do things like use the cool new Element service with Signal. But 1) I (finally) have a lot of contacts using Signal, so that would be a pain to manage; 2) to me, the entire idea of Signal is that I can pretty much set it and forget it on any relatively-modern smartphone for friends, family, etc.…

> I _could_ go to each of my contacts and explain why I don't want them to do things like use the cool new Element service with Signal. But 1) I (finally) have a lot of contacts using Signal, so that would be a pain to manage; 2) to me, the entire idea of Signal is that I can pretty much set it and forget it on any relatively-modern smartphone for friends, family, etc. and not have to worry about anything but the biennial phone migration for my mother.

Yes, I totally agree that this would be a huge hassle. But what's your proposed alternative? Reaching out to every programmer in the world and convincing them to never write any software that can act as a Signal client? Or pushing for legal prohibition on any non-Signal developers creating software that can act as a Signal client?

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#327

Post by Thorentis »

Conspiracy: Element has been taken over secretly by the US government, and Element One bridges will now have access to all the encrypted messages across multiple platforms that people assume are only destined for the recipient.

It's brilliant actually. The more I think about it, the more that Matrix bridges seem like a perfect NSA tool. It's a man-in-the-middle attack of grand proportions, hidden in plain sight.

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#328

Post by KAMSPioneer »

topdancing wrote: post #193
comice wrote: post #189

Earlier quoted context omitted.

> for encryption fans, I've been wondering for a long time now: why would you trust ANY 3rd party with your so sensitive data instead of running your own service? Are you not aware of OMEMO for XMPP? we ran our own XMPP server for over 10 years using the "off the record" plugin for end to end encryption. Development seem to basically stop on open chat clients a few years ago and everything started getting crufty. (I…

For the past two years; I've been using Conversations (Android), Dino (Linux), and friends of mine have been using Gajim (Windows), Monal/Siskin (iOS). All of these work fine with OMEMO (the iOS ones gained better OMEMO and push support in the past few months) and message history retrieval between clients. Gajim doesn't do inline images, but the rest do. I occasionally use profanity as a console client and that recen…

I use Conversations and Dino daily, they're awesome. When I'm stuck on MacOS or iOS I use BeagleIM and ChatSecure, though Monal looks a little more slick...maybe I should try that.

There are a few options yet for XMPP clients, I have some hope for the ecosystem...!

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#329

Post by TeMPOraL »

hypertele-Xii wrote: post #228
noahtallen wrote: post #162

Earlier quoted context omitted.

The real answer is because you want all your conversations to happen in the same app/protocol. You never have to download a shiny new messenger again

I'ved heard that pitch before. It's always true only for some length of time. Protocols change, services evolve, companies transform, products are deprecated and people are fickle. I've used all-in-one messengers before. They come and go like the wind. You'll be downloading a shiny new all-in-one messenger periodically anyway. Just trading one kind of inconvenience for another.

Perhaps if we normalized messenger interoperabiltiy, there would be less churn in "all-in-one" clients. That churn exists mostly because platforms actively fight their users on this.

And still, periodically changing an all-in-one messenger is still better than keeping and changing half a dozen messengers.

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#330

Post by KAMSPioneer »

tshaddox wrote: post #326
KAMSPioneer wrote: post #321

Earlier quoted context omitted.

I thought I addressed that in my original comment: I _could_ go to each of my contacts and explain why I don't want them to do things like use the cool new Element service with Signal. But 1) I (finally) have a lot of contacts using Signal, so that would be a pain to manage; 2) to me, the entire idea of Signal is that I can pretty much set it and forget it on any relatively-modern smartphone for friends, family, etc.…

> I _could_ go to each of my contacts and explain why I don't want them to do things like use the cool new Element service with Signal. But 1) I (finally) have a lot of contacts using Signal, so that would be a pain to manage; 2) to me, the entire idea of Signal is that I can pretty much set it and forget it on any relatively-modern smartphone for friends, family, etc. and not have to worry about anything but the bie…

Hahaha of course not. I don't really propose an alternative. I'm just lamenting the situation and trying to provide context to the Element CEO about why the original commenter, and people like him, might not be 100% jazzed about the democratization of technology that, in terms of message _security_, is a step backwards.

Doesn't mean I'm in favor of such ridiculous things as you've suggested here.

Post reply on HN