Element One – All of Matrix, WhatsApp, Signal and Telegram in one place • Hacker News Board

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#341

Post by gfodor » Tue, Oct 26, 2021, 10:19 PM UTC

ThatGeoGuy wrote: post #288

asymmetric wrote: post #260

Earlier quoted context omitted.

That is true, but there is a difference between some messages being screenshotted, and a service that acts as a bridge storing all communication that passes through an account. It's a matter of how likely it is that the assumption "my communication is not going to leak beyond the two participants" is broken. Every step in the wrong direction counts, IMO. Also, AFAIK it wouldn't be trivial to extract all the Signal ch…

It seems like you're trying to hold Element to some kind of impossible standard here. It's not like the tech they used to build the bridge didn't already exist. The bridge itself serves a specific purpose (opening up Signal to the Matrix API, allowing for the use of a single app), and succeeds at that. Of course there's a trade-off, and the team (at least allegedly) appears to be working on encrypted bridges so that…

Companies whose mission is centered on user control and privacy can be held to a higher standard than other companies when it comes to these kinds of questions. It's perfectly reasonable to suggest that Element should have tossed out the idea of supporting Signal for this specific software offering, given the potential for collateral damage in the form of person A using it without person B being aware of this, particularly if person A does not grok that they are compromising person B's communications if they are using it.

Disclaimers and warnings are not universal solutions to questions on ethics since they are not certain to be read or understood and will have some failure %. If the residual negative effects are likely to exceed the kinds of outcomes a company's core values can tolerate, then making those states unrepresentable by abandoning product ideas is sane.

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#342

Post by KingMachiavelli » Tue, Oct 26, 2021, 10:22 PM UTC

fsflover wrote: post #135

Arathorn wrote: post #125

Earlier quoted context omitted.

(Element CEO here). Honestly, it depends on your threat profile. Any kind of bridge has to inevitably MITM your conversations in order to work, and we’ve tried to spell that out in all the product info about Element One. If you want to avoid your E2EE conversations on Signal or WhatsApp being relayed via a service like Element One (because you’re an activist or whatever), then your options are to not bridge at all, o…

> Any kind of bridge has to inevitably MITM your conversations in order to work Can't you just pass the encrypted message further without decrypting it? Of course, there needs to be the same decryption mechanism on both sides, but it doesn't make it impossible.

It's possible but a lot harder. If the keys/tokens for fetching messages are similar/interlinked to those used to decrypt the messages then you can't separate the two. In this case you would have to do the message 'fetching' and decryption on the client side which would be very difficult for any JS based clients.

Then there's the issue of syncing those messages between Element One clients which means the client now has to re-encrypt the messages and send them back to the server. And if the client is responsible for fetching messages then providing push notifications will be very difficult.

So if you can actually decouple polling/listening for messages from decryption then it would probably be possible.

A brute force approach would be to provide an open source, self-hostable server but can be configured from the centralized Element One service. This server would hold the actual service tokens & decryption keys and would just be sending re-encrypted messages back to Element/Matrix.

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#343

Post by gfodor » Tue, Oct 26, 2021, 10:26 PM UTC

Arathorn wrote: post #125

tao_oat wrote: post #97

> It’s also worth noting that end-to-end encryption is necessarily broken as messages to (and from) WhatsApp, Signal and Telegram pass across the bridge(s). The bridge(s) operates in Element’s trusted EMS environment, with no content scanning or datamining, but currently bridged conversations are not stored end-to-end encrypted in Matrix (they will be in the future). As a Signal user, I kind of don't want this to tak…

(Element CEO here). Honestly, it depends on your threat profile. Any kind of bridge has to inevitably MITM your conversations in order to work, and we’ve tried to spell that out in all the product info about Element One. If you want to avoid your E2EE conversations on Signal or WhatsApp being relayed via a service like Element One (because you’re an activist or whatever), then your options are to not bridge at all, o…

Signal's core value proposition is radically increasing the expectation that one is having an e2e encrypted conversation. I love Element's product and mission, but a product which explicitly is eroding and complexifying privacy around a 3rd party product which is about privacy seems to be a bad tradeoff, and also stands to undermine the public perception of what Element is all about. I would suggest either carving out the e2e platforms (particularly Signal), or introduce functionality that will ensure conversations had through the bridge inform the counter party that the messages are not e2e encrypted. It's the right thing to do.

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#344

Post by [deleted] » Tue, Oct 26, 2021, 10:32 PM UTC

feanaro wrote: post #337

zepto wrote: post #276

Earlier quoted context omitted.

This is only true now that Element have introduced this compromised way to access signal. So yes, Element have introduced a new fact that downgrades everyone’s estimate.

> This is only true now that Element have introduced this compromised way to access signal. It's never not been true since Signal is just a protocol which you can use programatically. It's certainly not been true at least since signald became a thing. And Element is not the first one to come out with such an offering (see e.g. Beeper). It's just better known now.

[deleted]

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#345

Post by zepto » Tue, Oct 26, 2021, 10:36 PM UTC

feanaro wrote: post #337

zepto wrote: post #276

Earlier quoted context omitted.

This is only true now that Element have introduced this compromised way to access signal. So yes, Element have introduced a new fact that downgrades everyone’s estimate.

> This is only true now that Element have introduced this compromised way to access signal. It's never not been true since Signal is just a protocol which you can use programatically. It's certainly not been true at least since signald became a thing. And Element is not the first one to come out with such an offering (see e.g. Beeper). It's just better known now.

That makes as much sense as saying nuclear war was as likely before the Manhattan project as afterwards.

It was always possible to build nuclear bombs. It was just ‘better known’ after they were dropped on Japan.

And in this case “better known” is what is being criticized. It’s one thing for someone who understands how to do so to build their own proxy and take their own risks.

It’s another thing entirely to make a consumer product that does this and normalize the practice.

That hadn’t been done before by anyone credible.

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#346

Post by arp242 » Tue, Oct 26, 2021, 10:47 PM UTC

oblio wrote: post #87

arp242 wrote: post #70

Earlier quoted context omitted.

> I see the same thing here. While it's interesting, I'm failing to see what the use case is. What's the niche that needs this solved in a big way? I used Pidgin a lot. I always found it very convenient to have everything in one place and UI. Better one client than MSN + AOL + ICQ + IRC + Yahoo! + XMPP. In the last few years I haven't used it much, but that's because it just doesn't support the popular messaging apps…

Pidgin was extremely convenient. But it was commoditizing messaging platforms so of course it had to be shot in the head by them.

I don't think anything got "shot in the end"; the protocols of old were often just reverse-engineered too. Few bothered publishing anything about it, which is why Jabber/XMPP was created.

Since then encryption made things a lot harder; specifically, E2E encryption. You can't "just" login to a server and send messages, you need to encrypt and decrypt things on the device with the right keys, and how do you handle things like message history WhatsApp and Signal solve this for the desktop/web versions by designating your phone as the only device that can connect to their service, and everything else communicates via that phone. Telegram solves it by having regular chats not be E2E encrypted, and having a special "secret chat" feature for it.

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#347

Post by sneak » Tue, Oct 26, 2021, 11:03 PM UTC

Arathorn wrote: post #313

colbyhub wrote: post #294

Earlier quoted context omitted.

Not sure what exactly they were referring to, but here are some of them: https://github.com/libremonde-org/paper-research-privacy-mat...

sneak’s pet issue is https://github.com/vector-im/element-web/issues/11655 : that element web assumes that you want to log into the matrix.org homeserver by default unless you change its config to default to a different one. The libremonde research is over 2 years old now, and the valid bits of it were addressed at the time ( https://matrix.org/blog/2019/09/27/privacy-improvements-in-s... )

I've user accounts on 3 different servers, run by 3 different groups.

Every single one of them has a configuration, despite a selfhosted instance, that phones home to centralized servers run by your for-profit company.

I'm not sure if this systemic problem is in your config files, your documentation, your defaults, your js client, or what. It's a failing of some part (or multiple parts) of the process.

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#348

Post by mr_johnson22 » Tue, Oct 26, 2021, 11:05 PM UTC

Launching with bridges to already-encrypted messengers, then immediately admitting this has to MITM them to work, doesn't make a good first impression...especially since users of these messengers will likely be more privacy-minded than most.

This is also making a bet that the inconvenience of juggling these 3 particular messengers is worth $5 a month.

IMO the real value in Matrix bridging that's been neglected (and has been mentioned elsewhere in these comments) is connecting different messengers _to each other_. Being able to connect friends/family scattered across different, otherwise-isolated protocols with a single "just works" tool is a much clearer value proposition than what feels like just another multi-protocol client.

Alas, getting that kind of multi-connectivity is tricky...as is VoIP bridging, which this doesn't support either, but should be considered as crucial for any Matrix bridge.

I don't doubt Matrix/Element will get there at some point, but for now this feels a tad premature.

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#349

Post by Forbo » Tue, Oct 26, 2021, 11:10 PM UTC

grassjumper wrote: post #192

xanaxagoras wrote: post #145

Earlier quoted context omitted.

> (because you’re an activist or whatever) How about because I'm a regular person, and I don't want everything I say analyzed by the federal government and stored in perpetuity? I'm increasingly repulsed by this notion that unless I'm doing something illegal or in opposition the the ruling party, encryption is just a luxury. Encryption is for anyone with any desire to express themselves honestly without modifying the…

I very much agree with you. > I'm increasingly repulsed by this notion that unless I'm doing something illegal or in opposition the the ruling party, encryption is just a luxury. Making encryption and privacy a common thing is important to maintain the anonymity of those who have something to hide for various reasons. It's the same as law enforcement using dubious methods: We don't object because we're criminal, we o…

All your comments appear dead to me, I think it's because you're a fresh account and have been shadow banned. Just guessing, I'm not sure about that but I saw similar behavior for another user on a different topic. I vouched because it looks like you're making points in good faith.

Re: Element One – All of Matrix, WhatsApp, Signal and Telegram in one place

#350

Post by broodbucket » Tue, Oct 26, 2021, 11:19 PM UTC

teekert wrote: post #152

tao_oat wrote: post #97

> It’s also worth noting that end-to-end encryption is necessarily broken as messages to (and from) WhatsApp, Signal and Telegram pass across the bridge(s). The bridge(s) operates in Element’s trusted EMS environment, with no content scanning or datamining, but currently bridged conversations are not stored end-to-end encrypted in Matrix (they will be in the future). As a Signal user, I kind of don't want this to tak…

I won't use it for signal indeed, for whatsapp though... can't wait to throw it of my phone!! I didn't dive into it, but can you also self-host this? Looking forward to some docker-compose snippets in that case :)

Here you go: https://docs.mau.fi/bridges/go/whatsapp/setup/docker.html

Element One uses a modified mautrix-whatsapp, which means that your phone needs to be connected to the internet for the bridge to work - so you can't quite throw it off your phone. I don't have to regularly open the app or anything, though.