I want to switch to SimpleX Chat[1] but at the moment there are issues with battery usage on android devices because of the way notifications are done. I hope this[2] or some other solution get merged soon even if there is a slight impact on anonymity.
Verifying your Matrix devices is becoming mandatory
121–130 of 251 posts
Re: Verifying your Matrix devices is becoming mandatory
#122Earlier quoted context omitted.
You don't have to use E2EE if you don't want to. I personally don't because I don't care about it, and it adds extra difficulties to the experience.
If you don't need e2ee, are there features that make matrix better than xmpp?
Both XMPP (via OMEMO) & Matrix use libsignal for double-rachet encryption—so they have the same encryption properties. The biggest practical differences for the average user in my opinion is XMPP has a separate concept for DMs (not a 2-user room with encryption like Matrix), XMPP allows encryption to be both enabled then later disabled, & Matrix offers better resilience as messages & attachments get synced to all servers a room (which has a massive downside of resources, storage sizes, & moderation; if a server goes offline, you still have a history of the chat but if someone shares something explicit, such as CP, it will propagate thru the network & there is no way to delete it across nodes).
One of the better comparisons out there: https://www.freie-messenger.de/en/systemvergleich/xmpp-matri...
Re: Verifying your Matrix devices is becoming mandatory
#123I tried implementing a Matrix bot a few months back, and it was an absolutely miserable experience, since Device Verification/E2EE was not working with any of the available open source Python implementations I found.
I then stumbled upon their internal Rust SDK[1] that they use for Element X, which is actually quite nice, and even has FFI bindings for Python and Kotlin[2]. Unfortunately the documentation was really lacking at the time. I managed to put something together with the help of an LLM and the source code and examples to find my way around the various APIs, and it actually works with emoji verification and E2EE (although there are weird bugs around synchronization, but that's probably just an API misuse on my end).
It seems they've improved the documentation since and even provide a reference client[3] to see how things work.
[1] https://github.com/matrix-org/matrix-rust-sdk
[2] https://github.com/matrix-org/matrix-rust-sdk/tree/main/bind...
[3] https://github.com/matrix-org/matrix-rust-sdk/tree/main/labs...
Re: Verifying your Matrix devices is becoming mandatory
#124"Now the end-to-end encryption will leak into the UX even more and you better like it" I'll say it again: E2EE will never become mainstream unless someone somehow manages to implement it such that it's completely transparent to the user while keeping all the features that people have come to expect from IM apps, like server-stored conversation history or support for multiple devices. By "completely transparent" I mea…
If that's true, then E2EE will never become mainstream. Consider this scenario: "My phone got lost/stolen/broken, so I just got a new one. I haven't logged in to this app since I got my last phone, so I forget my credentials for it. I'll reset them through my email. What do you mean my conversation history is gone?" That's not really far-fetched. If you can get your conversation history back in that scenario, then so…
> If that's true, then E2EE will never become mainstream
Yes? :)
Given the choice, the vast majority of people would pick convenience over the kind of security that requires this much effort.
Re: Verifying your Matrix devices is becoming mandatory
#125Conspiracy theory time...
Matrix is the Firefox of chat apps. Castrated on purpose and kept around as a "see how much worse than WhatsApp things can really be!"
Re: Verifying your Matrix devices is becoming mandatory
#126I decommissioned my server 3 months ago and migrated my community back to IRC. I still had the IRC Podman containers kicking around, so that was easy. I dealt with ~monthly issues around my devices not being correctly verified, messages not correctly decrypting, and various other rough UX edges. There seemed to be a lot of velocity in the beginning but the last couple of years have addressed approximately nothing in…
Anecdotal but running a server with multiple bridges for multiple years.
Had such issues initially but none recently.
Re: Verifying your Matrix devices is becoming mandatory
#127Earlier quoted context omitted.
It’s terrible. I had to leave most channels on the matrix.org namespace because they won’t properly moderate their own server from CSAM. I dropped to 7 day media retention to lower legal liability on my own server, since there’s no way to know when one of my users will be in a channel hit with abuse. At this point the majority use case I have for matrix is to bridge to IRC with heisenbridge and be able to use signal…
Have they done anything to mitigate this? Like client side filters or message scanning for new direct messages?
The main things are https://matrix.org/blog/2025/04/introducing-policy-servers/ (for flexible serverside moderation) and the rest of the stuff in https://matrix.org/blog/2025/02/building-a-safer-matrix/. Clientside filters already existed, but given they only apply per client and there are a lot of different clients, we focused on serverside filtering.
Re: Verifying your Matrix devices is becoming mandatory
#128"The authenticity of this encrypted message cant be guaranteed on this device" both sides verified, but this still randomly pops up, what happens then? will i lose those messages in the future?
No, it's just a warning that your client can't prove that the message was really sent by that sender. These will eventually go away once https://github.com/matrix-org/matrix-spec-proposals/pull/404... lands.
Re: Verifying your Matrix devices is becoming mandatory
#129I decommissioned my server 3 months ago and migrated my community back to IRC. I still had the IRC Podman containers kicking around, so that was easy. I dealt with ~monthly issues around my devices not being correctly verified, messages not correctly decrypting, and various other rough UX edges. There seemed to be a lot of velocity in the beginning but the last couple of years have addressed approximately nothing in…
If IRC suffices for your purposes, then Matrix, with its encryption and all, is apparently overkill. If I were to upgrade an IRC-based community to something newer and richer, I'd go with Jabber, well-known, well-established, with a ton of various clients and several servers. Yes, it's not ideal, but it's still a massive upgrade compared to IRC, if your server supports a good list XEPs and your community members agre…
> If IRC suffices for your purposes, then Matrix, with its encryption and all, is apparently overkill.
IRC has encryption too. You run it over TLS.
Re: Verifying your Matrix devices is becoming mandatory
#130Earlier quoted context omitted.
I wouldn't characterize Signal as "absolute most possible safety" as you are implicitly doing here. I would probably characterize Signal as "most possible safety for the average nontechnical user" which entails trade-offs against absolute safety for certain UX affordances (and project governance structures that allow for these decisions to be made), because if said affordances are not given, the average nontechnical…
I couldn't be less interested in arguing with you about Signal. My point is that it doesn't make as much sense to compare Signal and Matrix as people think it does. Large-scale group chat is intrinsically less safe than the kind of chats most people use Signal for. You can substitute whichever other secure messenger you prefer. This "average nontechnical user" stuff, though, miss me with. For 2 decades people have be…
I have started using Signal for large group chats in the past year or so, after spending many years using it as an encrypted replacement for SMS texting. Signal has gotten noticeably better at the UX of group chats during that time, although I am still annoyed that they basically require you to use their client to access the network in the name of security. I can't easily run a legitimate 3rd party Signal client on my server, and when I've tried I've accidentally broken my access to my account on my phone, which is quite annoying since I use Signal pretty frequently.
I want there to be something like Matrix that is designed first and foremost as a large-group realtime chat program (really, as a meaningful FOSS alternative to Discord), and it should make different tradeoffs than Signal. I'm actually willing to entirely forego encryption, at least at first, to make this happen - IRC wasn't encrypted and Discord isn't either, and these are things I want to replace with something better. Matrix's UX is still noticeably worse than Discord's, and I'm skeptical that the ostensible security gains from the encryption are worth it, especially given the problems with device verification UX, metadata leakage, and the fact that as the number of people in a group chat grows the possibility that they will take a screenshot of the encrypted message sent to them and leak it to the press grows higher and higher.