dngray

dngray, 10 months ago

Related thread here discuss.privacyguides.net/t/…/13274The main thing we find is Vanadium is not lagging behind upstream and it has hardening patches that a lot of other WebView implementations do not have. Whether you like a to “contribute to chromium based market share” you’ll have a WebView implementation on your Android device used by apps you use. It’s also worth noting that per site isolation doesn’t seem to be a thing on Android for non-chromium browsers.

dngray, 10 months ago

Vanadium is built specifically for security. It lacks privacy features such as an ad blocker

Currently I use the AdGuard DoH server. It’s not perfect, but I don’t do a lot of browsing on my phone. There were some plans to implement this in vanadium github.com/GrapheneOS/Vanadium/issues/10

dngray, 10 months ago

leaks more metadata than XMPP

XMPP is not a private protocol either. In a lot of cases data is not E2EE, there is no reference clients and there’s a mess of standards that very few if any clients fully implement.

dngray, 10 months ago

Session has no server so that’s what I’d recommend if you have the option.

Closed rooms in session are limited to 100 people iirc. You can have Matrix rooms with any number of users.

dngray, 10 months ago

That is the nature of any federated protocol.

E2EE works well enough within rooms and that is likely where private data is to be anyway. As long as you Matrix and assume that everyone can see your Matrix ID and room IDs you’ll be okay.

XMPP isn’t any better in that regard.

dngray, 10 months ago

Yes, but Matrix leaks way more metadata to other servers

FUD, Matrix doesn’t leak any more data than XMPP in that regard. Admins of either service can know what rooms you’re in and information about events such as time they were sent.

XMPP isn’t any better in this regard.

dngray, 10 months ago

Element web-client also phones home

It doesn’t send metadata about your use. There is a version check though.

dngray, 10 months ago (edited 10 months ago)

you’re referring is using XMPP without OMEMO

OMEMO encrypts text messages for VOIP you need DTLS-SRTP encryption or Jingle session encryption. OMEMO has no concept of cross signing, ie one device being trusted and therefore the others either if they do an authentication with each other. Device verification has to be done each session which is a massive pain.

warns you your message content is unencrypted if this is disabled

The point is that Matrix 1:1 calls are always encrypted and soon with MSC3401: Native Group VoIP Signalling 1:many VOIP calls will be as well. Having foot guns about what might be encrypted or not in a client isn’t very private at all.

Also, XMPP has better (imo) and more numerous clients than Matrix on every platform except iOS and MacOS (No better XMPP client than Element on these platforms).

I’ve used Nheko and that’s pretty good. Last time I checked the XMPP clients that existed had a lot of rough edges and feature inconsistency.

I definitely prefer an extensible protocol to a much heavier, metadata-leaking, less-feasible to self host solution like Matrix.

That is definitely your opinion, Matrix has shown to be very feasible in a commercial sense as there are many providers and commercial clients using it, french, german government etc. There are also quite a few clients using EMS. They claim: “Matrix is an open network for secure, decentralised communication, connecting 80M+ users over 80K+ deployments.”

Which is probably a lot more than XMPP.

Matrix really can be quite lightweight enough that it will be entirely possible to run a homeserver locally in WASM which is what the Matrix P2P project is about. arewep2pyet.com has more details about that. It’s also possible to have very light Matrix servers Breaking the 100bps barrier with Matrix, meshsim & coap-proxy. The reason that a lot of public Matrix servers are quite “heavy” is because they have many numbers of users, and activity. Synapse has also made huge gains in this regard to what it was originally, and we know that Dendrite uses a lot less resources (that I’ve tested privately).

With RFC 9420 aka Messaging Layer Security (MLS) it should be entirely possible to have large E2EE rooms without too much of a performance hit. Matrix is also working on MLS: A giant leap forwards for encryption with MLS. They have a site tracking that: arewemlsyet.com

The point is a lot of testing and thought goes into these things.

metadata-leaking

You’re pretending XMPP doesn’t have metadata between servers, it certainly does it’s really no more private than Matrix.

This is what Matthew Hodgson (Arathorn) - CEO of Element had to say about it in March 13, 2022:

Talking of sloppiness, that hackea.org article is a huge steaming pile of FUD about Matrix.

For what it’s worth, the team who came up with Matrix was originally based in two separate startups: one in the UK doing VoIP, one in France doing mobile dev. Both got acquired by Amdocs in 2010, but we ended up forming an independent “incubated startup” first to build telco apps, and then we came up with the idea of Matrix in ~2013. We then built out Matrix until 2017 when Amdocs killed our funding, having run out of patience for what amounted to generous FOSS philanthropy.

We then set up New Vector (now Element) as an entirely independent UK/FR startup, and have received zero funding from Amdocs since. To be crystal clear: Amdocs has zero privileged influence or control over Matrix (or Element, for that matter), and has zero access to the Matrix servers we operate as Element. And besides - the whole point of Matrix is that you can and should run your own servers so you can pick who to trust, even if you don’t trust the project itself.

dngray, 10 months ago

you have to attach your matrix ID to your phone number

Yes, this is FUD, it’s not necessary, and entirely opt-in. Also you don’t even need to connect to the identity server.

dngray, 10 months ago (edited 10 months ago)

Yes the article is FUD and sloppy. This is what Matthew Hodgson (Arathorn) had to say about it:

Talking of sloppiness, that hackea.org article is a huge steaming pile of FUD about Matrix.

For what it’s worth, the team who came up with Matrix was originally based in two separate startups: one in the UK doing VoIP, one in France doing mobile dev. Both got acquired by Amdocs in 2010, but we ended up forming an independent “incubated startup” first to build telco apps, and then we came up with the idea of Matrix in ~2013. We then built out Matrix until 2017 when Amdocs killed our funding, having run out of patience for what amounted to generous FOSS philanthropy.

We then set up New Vector (now Element) as an entirely independent UK/FR startup, and have received zero funding from Amdocs since. To be crystal clear: Amdocs has zero privileged influence or control over Matrix (or Element, for that matter), and has zero access to the Matrix servers we operate as Element. And besides - the whole point of Matrix is that you can and should run your own servers so you can pick who to trust, even if you don’t trust the project itself.

dngray, 10 months ago

As for the metadata leaking, while metadata is obviously available to the admins of the servers you and you recipient are using, these chat histories are not synced in their entirely,

Maybe so, but for a public room it really means nothing because they could just join it anyway. Every client has a copy. The point is neither system has deniability in terms of “I was never talking to this person”. I do think there is more utility in Matrix’s future with P2P accounts however, that don’t depend on a single Matrix server and can be rotated. Anything you aim to be anonymous with should be regularly rotating accounts as we suggest. Take a look at XMPP: Admin-in-the-middle. Admins can get more than enough.

SimpleX chat addresses most of Matrix and XMPP’s shortcomings

Except there is no desktop client, and I’m not sure how it will work at scale. It does not have anywhere near the feature set of Matrix. The whole “spaces” thing is the beginning and I suspect they’ll be doing a lot more there, specifically: “Spaces effectively gives us a way of creating a global decentralised filesystem hierarchy on top of Matrix”.

I hope it can one day replace them.

I honestly doubt that will ever happen they aren’t really competing products. Matrix is really meant for large scale networks, a bit like a whole social media platform, whereas SimpleX is more like a competitor to Signal or Session.

I would like to see Decentralised user accounts and I think they may be still looking at this because it would be nice to be able import your account somewhere else if a home server you’re on shuts down or something.

dngray, 10 months ago

For instance my phone number isn’t tied to my Matrix account

It isn’t for anyone using any client unless they optionally decide to provide it.

They talk of Matrix being centralized but that only really applies if you use the Matrix home server, there are many alternatives

Indeed: joinmatrix.org/servers/ and that’s not even getting started on the private ones or unlisted ones.

is it betetr than Discord for privacy and security ?

100% Discord has no privacy no encryption, the company sees absolutely everything.

Discord is clsoed source so nobody knows what it gives up or does in the background

That doesn’t necessarily impact privacy, and we know exactly what it does in the background based on their privacy policy, which in itself is quite ambiguous in parts. They’re quite happy there to admit they will tie identities together if you use social media logins and features like that.

No closed source program can be trusted over a FOSS option

I would say be careful here, because something is open source doesn’t necessarily mean anyone cares about what the code is actually doing. In the case of Matrix it is a very active project with a lot of community engagement and a well thought out specification so that everyone can “get up to speed”. That is extremely important. Nobody is going to sift through a tarball of source code “it’s open source”, if the development is not. It’s also totally possible for a patched version to be running in production that doesn’t reflect the source code.

That is why it’s very important not to confuse FOSS with privacy.

dngray, 10 months ago

If the audits are public and they are actually funded with proper scope that may very well be better than some very small project nobody can be bothered looking at. I’m not saying having source is a bad thing, quite the opposite. Privacy is generally gained through security controls, and just because something is open source doesn’t mean it is secure, likewise if something is closed source that doesn’t necessarily mean it is insecure as this post describes.

dngray, 10 months ago

I am sure that Tutanota does not use any custom encryption algorithm. It is clearly stated in the FAQ that they use RSA (with PFS) and AES to encrypt emails exchanged between Tutanota users. tutanota.com/encryption

These are only primitive algorithms, the actual implementation is custom and specific to Tutanota, which mean it will only work with Tutanota as nothing else will implement it.

There is no way to do key distribution outside of Tutanota’s service.

dngray, 10 months ago

Then why post it and spread FUD?

Deleted by Mod.

People please try to remember the rules about substantiating your content/posts.

dngray, 10 months ago

Plus their unwillingness to open source it and not sharing the audits just doesn’t inspire my confidence.

The server side isn’t open source, and you can’t verify that is what is actually running in production. While we do recommend it I don’t personally use their products.I like the use of email clients, particularly customized to my needs.

Nested folders was only a very recent feature added tutanota.com/blog/posts/subfolders and without that I wouldn’t even consider a provider as I use this for organization. Of course as you can’t use your own email client, downloading email from Tutanota can be a bit of a pain too, you can only export per-folder into Mbox.

dngray, 10 months ago (edited 10 months ago)

which has been proven to be less than 100% airtight and secure.

I don’t believe that has been proven. There has been criticism of it 1, 2 from prominent cryptographers though.

Telegram’s MTProto protocol isn’t obviously broken in a practical way, concedes Matt Green, a cryptographer at Johns Hopkins University who has consulted for Facebook on encrypted messaging systems. But it’s uniquely “weird,” he says, in a way that suggests its inventors don’t understand tried-and-true cryptography practices and raises his suspicions that it may yet have undiscovered vulnerabilities.

Their response was even more dodgy trying to somehow inject some sort of “nationalistic”, “america bad” into it:

Telegram’s Ravdonikas argues that “Telegram encryption relies on classical algorithms, because we consider some approaches promoted by US-based cryptographers after 9-11/the Patriot Act (which your sources refer to as ‘state of the art cryptography’) questionable."

At the end of the day math is math regardless where it comes from. Secret chats also only work with the mobile client, have to be manually turned on and do not work for group chats and as it’s a centralized server you can’t host your own.

And with RFC 9420 aka Messaging Layer Security (MLS) being standardized, it’s likely all the good messengers will use that.

dngray, 10 months ago

Probably another point is that the encryption for Matrix/Element has undergone multiple audits, one in 2016 and another one of their newer rust library. Whereas telegram just has not. There was this also a not too long ago. MTProto is also used nowhere else, whereas a lot of encryption has been influenced by the Double Ratchet which is well understood.

The other thing worth noting is that Matrix is the foundation for other products which many governments use for secure communications.

dngray, 10 months ago

I certainly think so.

Even Windows or Chrome OS, provides quite a bit of “control” it’s just that a lot of it is “opt out”. Google does, for example record what YouTube videos you look at against a logged in account by default. Windows does have targeted advertising enabled by default.

I think privacy is really more about what you do on such platforms. If you use products (sites) that clearly have bad policies in regard to privacy then no OS is going to provide really all that much improvement.

dngray, 10 months ago

Stopped reading at “storing my passwords on a db”. Even if you encrypt the data, is it not just plain better to use a generative algorithm for passwords instead that needs no cloud?

There are quite a few reasons why we don’t recommend deterministic password managers and I have been meaning to write an article about it. There is a summary and further discussion in that thread.

Third party blog article which is still relevant tonyarcieri.com/4-fatal-flaws-in-deterministic-pa…

dngray, 10 months ago (edited 10 months ago)

Generally we’d say no, not really, and certainly not with the highest security.

The whole point of a security key is that it is supposed to be impossible to extract the key material, that simply isn’t going to be the case for a DIY solution. They have shields, and light sensors to prevent decapping/forensic inspection.

Recommend taking a look at this: duo.com/…/microcontroller-firmware-recovery-using…

dngray, 10 months ago

If you’re going to use Arch use Arch. It is incredibly dangerous to be blindly trusting things in AUR, when they can be contributed by anyone.

However, it then goes on to say that only moderate or advanced users should use Arch

Yes because there is less QA, there is nobody testing those things before they are released to you. It also requires you to make a lot of selections which unless you know what components to choose (I also use Arch) would be not great for a newbie user.

I find this funny as many corporate servers use Debian, and I don’t really see any huge security issues since the 90’s waving red flags of warnings and issues.

A lot of them are Ubuntu these days, or Centos. In a corporate environment you tend to be running a lot of containerized workloads because you want redundancy, and high availability.

By following this guide, it really leaves no option for beginner linux enthusiasts. I (we) recommend not folloing this guide as it reads like privacy paranoia propaganda piece.

TLDR being there is no reason to look beyond Fedora or Ubuntu for a newbie user. That is the point that it makes. These other obscure distributions don’t provide anything that you need.

dngray, 10 months ago

Keep in mind LocalCDN will make your fingerprint more unique. HTTPS Everywhere is unmaintained and no longer needed… and you certainly don’t need Decentraleyes, thats a duplicate of LocalCDN and is also unmaintained.

dngray, 10 months ago

It’s described in the documentation for uBO github.com/gorhill/uBlock/…/Static-filter-syntax#…

dngray, 10 months ago

I disagree, the whole usecase for decentraleyes (although i’d recommend localcdn instead as it supports a lot more frameworks), if for users not using a vpn, in which case you’d be fingerprintable via your ip address anyways, what localcdn achieves is having privacy from third parties, as opposed to the website itself.

That is not how it works. It modifies your fingerprint because its no longer requesting certain resources. Even one of the Tor developers points that out and it’s why it’s mentioned on github.com/arkenfox/user.js/wiki/4.1-Extensions#-…