Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Element (Matrix) launches Chatterbox, end-to-end encrypted embedded chat

element.io

Post reply on HN
Print view View original

51–60 of 93 posts

Re: Element (Matrix) launches Chatterbox, end-to-end encrypted embedded chat

#51

Post by cheesewhizemacs »

t6jvcereio wrote: post #42
jeroenhd wrote: post #24

Earlier quoted context omitted.

I'm running it on my own server and performance is quite acceptable. Picking the right client is very important, though; Element isn't always the fastest, and I find Cinny's UX to be much better for general chat, which is clearly very much… inspired by Discord. On the other hand, Element is ahead in terms of features and protocol support (like the (live) location sharing feature), but Fluffychat has the superior mobi…

I'm not sure the problem was the client (element for Android). Asking around it seems people on the chatrooms kind of agreed the issue was matrix.org Regardless, if you believe the issue is the client, which would you recommend is the lightest/fastest client?

The problem of slow joins isn't the client, it's the protocol. Just join the Synapse admins channel on matrix.org (will take half an hour to load, your client will time out and give you an error but it will load eventually) and the other admins will tell you they're all aware of the problem.

I don't know why Arathorn is further down the thread dismissing this problem.. it's a well-known problem in the community..

https://github.com/matrix-org/synapse/issues/1211 there's the seven year old bug

Re: Element (Matrix) launches Chatterbox, end-to-end encrypted embedded chat

#52

Post by eis »

woojoo666 wrote: post #43
lawl wrote: post #37

Earlier quoted context omitted.

But they host the software, you already have to trust them. This threat model just does not make sense.

The user has to trust the business no matter what. Even if the chat was e2e encrypted, the business could just choose to share the messages with somebody else. This use case is more for the business, who knows that the chat is hosted by a 3rd party, but is reassured that the 3rd party wont have access to messages.

The point is that the host can modify the code at will and can therefore access the messages if they wanted to. It defeats the idea of e2ee which is to make it impossible for a middleman to access the messages.

With e2ee you have to trust the client. But a client that is running as a website hosted by someone else can't be trusted as the host can modify it and you'd never known because browsers don't have a way to alert you when a site changed.

The only way this makes sense is if you (or your business) self-hosts.

Re: Element (Matrix) launches Chatterbox, end-to-end encrypted embedded chat

#53

Post by t6jvcereio »

Arathorn wrote: post #11
t6jvcereio wrote: post #8

Incidentally I tried matrix for the first time on the basis of someone recommending it here in HN, and it's extremely slow

this is like saying “i tried the web, and it’s extremely slow”. what server were you using? and which client on which platform?

> this is like saying “i tried the web, and it’s extremely slow”

Uuuuuh ok...? WhatsApp isn't slow.

Re: Element (Matrix) launches Chatterbox, end-to-end encrypted embedded chat

#54

Post by woojoo666 »

eis wrote: post #52
woojoo666 wrote: post #43

Earlier quoted context omitted.

The user has to trust the business no matter what. Even if the chat was e2e encrypted, the business could just choose to share the messages with somebody else. This use case is more for the business, who knows that the chat is hosted by a 3rd party, but is reassured that the 3rd party wont have access to messages.

The point is that the host can modify the code at will and can therefore access the messages if they wanted to. It defeats the idea of e2ee which is to make it impossible for a middleman to access the messages. With e2ee you have to trust the client. But a client that is running as a website hosted by someone else can't be trusted as the host can modify it and you'd never known because browsers don't have a way to al…

Another option is for the business to host the (open source) chatbox themselves, but the messages are stores and routed through a 3rd party. The chatbox is probably just a plug and play component that can be embedded in any page, and hosted statically by the business. Much easier than self hosting the entire messaging infrastructure.

This is one of the major benefits of having an open protocol like Matrix. The clients are separate from the servers. People with more resources and more expertise can host the servers, while regular users just need to download an open source client, and they can rest assured that the messages are secure.

Re: Element (Matrix) launches Chatterbox, end-to-end encrypted embedded chat

#56

Post by hda2 »

This is very interesting. Does Chatterbox require agents to use specialized matrix clients to interact with customers or will any matrix client do? (e.g Element for android)

If any matrix element would do, how will new customers appear in the client? Will they pop up as a new direct chat?

Re: Element (Matrix) launches Chatterbox, end-to-end encrypted embedded chat

#57

Post by ajbura »

lelandfe wrote: post #30
jeroenhd wrote: post #24

Earlier quoted context omitted.

I'm running it on my own server and performance is quite acceptable. Picking the right client is very important, though; Element isn't always the fastest, and I find Cinny's UX to be much better for general chat, which is clearly very much… inspired by Discord. On the other hand, Element is ahead in terms of features and protocol support (like the (live) location sharing feature), but Fluffychat has the superior mobi…

Cinny user registration told me my username was already taken, and threw up a never ending captcha[0]. I nevertheless got a "validate your email" in my inbox, although I can't login. Not, like, a great start. [0] https://imgur.com/a/zYBZWoW

https://github.com/cinnyapp/cinny/issues/664 Thanks for the bug report.

Re: Element (Matrix) launches Chatterbox, end-to-end encrypted embedded chat

#58

Post by hda2 »

maxloh wrote: post #12

What is the benefit of end to end encryption in this scenario? There is no risk of service provider spying on you because you as the business is the service provider.

E2EE can prevent the leaking of private conversations to thirdparty middleware/cloud companies. This would allow orgs to continue using those thirdparty services to handle their traffic like usual, but would also guard against middleware disasters like cloudflair's leaking of https traffic.

Thanks to the prevalence of early HTTPS termination (usually at the edge of some big cloud company), that green pad lock at the top of your browser means little when true privacy is needed.

Re: Element (Matrix) launches Chatterbox, end-to-end encrypted embedded chat

#59

Post by Pakdef »

woojoo666 wrote: post #47
Pakdef wrote: post #35

Earlier quoted context omitted.

> With E2EE I don't think you can even implement a reliable export on the server side. Can't you use your client key(s)?

The client would have to fetch all your messages first. Some rooms can have thousands of messages a day, and some people are in thousands of rooms [1] (though these are core developers so they might be stress testing) [1]: https://news.ycombinator.com/item?id=32021303

but you would hopefully not export all messages every time? incremental?

Re: Element (Matrix) launches Chatterbox, end-to-end encrypted embedded chat

#60

Post by hda2 »

tcfhgj wrote: post #5

How does E2EE work here? How can the user know their communication isn't being intercepted?

Normal users will probably just check that the green padlock in their address bar.

I think this is targeted towards securing chat traffic from thrid-party hosting services accidentally leaking or passively spying on you. Think problems that arise from early HTTPS termination like the cloudflair's https leak.

Post reply on HN