Anyone else wondering?
Then, it would be called matrix? 🤔
What If: Signal Was Part of the Fediverse?
Submitted 1 year ago by mossy_capivara@midwest.social to fediverse@lemmy.world
Comments
gelberhut@lemdro.id 1 year ago
poop@lemmy.blahaj.zone 1 year ago
Only if the signal crew collectively fell down, hit their heads and forgot about their whole mission of protecting metadata privacy. Matrix is a privacy nightmare (compared to signal). It offers optional encryption for the actual text of the messages sent, but everything else from room membership lists to reactions are unencrypted and stored for every by the server. The end to end encrypted message feature was bolted on after the rest of the thing was built, and it shows.
We’ve seen signal.org/bigbrother/ where signal proudly shows that they don’t have any metadata about their users to turn over. There’s a reason we don’t see anything like this for matrix.
Matrix is good at federating, but fucking horrible at keeping your information safe.
derin@lemmy.beru.co 1 year ago
I don’t think you understand why current servers operate the way they do.
Matrix server implementations function on the idea that your data lives in the server, so of course it needs that information (who is here, who is talking to whom) - or else, as an example, if you lost your devices you wouldn’t be able to recover your info (like on Signal).
I don’t want Signal’s Peer-to-Peer solution. I own my server, so I’m okay with keeping my own metadata. I want my communications with others to be encrypted, but recoverable if I lose access to my devices.
I think what you want is a Peer to Peer encrypted solution, which Matrix is working on, but isn’t available yet.
Follow this site for info on Matrix’s progress in that space: arewep2pyet.com What you’re looking for is info on Pinecone.
TLDR: poop wants a peer-to-peer encrypted network, Matrix is not that, so poop runs their mouth a little.
Matrix’s architecture today means that the servers can see who their users are talking to, and when - but not what (assuming it’s end-to-end encrypted). Just like a PGP mail service like Protonmail. Because Matrix stores conversation history on the server (unlike Signal) so you can get at it when from multiple logins, you end up with that metadata stored on the server.
We’re fixing this by working on P2P Matrix (as per the blog post - it’s one of the main initiatives that the funding is going towards). matrix.org/blog/2020/…/introducing-p-2-p-matrix explains how P2P addresses the metadata problem.
(…)
mossy_capivara@midwest.social 1 year ago
I’m not super familiar with matrix, is it end to end encrypted likesignall?
WheelcharArtist@lemmy.world 1 year ago
Yes it is. But there are alsi unencrypted chats/rooms
comcreator@lemmy.world 1 year ago
Matrix is the federated alternative to Signal.
However it would be cool to see Signal implementing their encryption into Matrix and turning Signal into a Matrix provider, becoming a federated messanger.
Molecular0079@lemmy.world 1 year ago
I believe Matrix already supports
olmwhich is the same encryption technique used by Signal. The main issue with Signal becoming federated is that in order to make the federation work, a lot of metadata will leak and that could be a cause for concern when using Signal as a private messenger for important things like whistleblowing, etc.comcreator@lemmy.world 1 year ago
True
nickavem@lemm.ee 1 year ago
Though the fediverse is good for a lot of things, security is not one of them. Maybe this will change in the future, but right now there are just too many chances for bad actors.
mossy_capivara@midwest.social 1 year ago
I heard that’s the case, but hey it’s FOSS maybe it’ll change in the future
WhoRoger@lemmy.world 1 year ago
Not a fan of giving my phone number to federate to every server.
Session is like Signal but decentralised (like Tor, not like Fedi) and without the phone no requirement. That sounds better to me.
dismalnow@kbin.social 1 year ago
Appreciate the heads up on session.
jet@hackertalks.com 1 year ago
Session doesn’t have perfect forward secrecy. Session also depends on the oxen Blockchain not collapsing.
Session has its uses, just be aware.
WhoRoger@lemmy.world 1 year ago
Maybe, but if I want to privately talk to randos from the internet, then using my phone number like with Signal is a no-go from the start. Threema is paid and only partially open source.
Session is fully decentralised and while you can think of crypto whatever, at least it gives people the incentive to run nodes, unlike Tor where the incentives are all over the place, or centralised messengers which are fully reliant on one entity.
Noki@kbin.social 1 year ago
Can you link the project you mean? Cant find “session”
WhoRoger@lemmy.world 1 year ago
hitagi@ani.social 1 year ago
Do you mean decentralized or federated? I don’t really see how Signal would work with something like ActivityPub where so much information is meant for public viewing.
There’s also Matrix if you’re looking for just decentralized and federated.
mossy_capivara@midwest.social 1 year ago
I was thinking more in the finding contacts way since Signal only uses phone numbers
hitagi@ani.social 1 year ago
Try Matrix or XMPP.
poop@lemmy.blahaj.zone 1 year ago
All of the people recommending matrix don’t understand why signal is secure. Matrix offers the same level of end to end encryption as Facebook Messenger, but it’s federated so people who care more about federation than privacy like to misrepresent its safety
caboose20@kbin.social 1 year ago
I will admit I don't understand why Signal would be more secure than Matrix. I understood Signal to have E2EE just like Matrix.
poop@lemmy.blahaj.zone 1 year ago
That’s fair! If you’re on these type of forums, there are a lot of Signal haters and a lot of Matrix lovers, and sometimes they like to confusing or just straight up inaccurate statements. The crux of the issue is not about the encryption of the text of messages themselves, which both platforms are capable of doing. Personally, I wish there was something like Signal but without the centralization, but the reality is such a thing doesn’t exist.
Signal (as in the Signal server and by extension the legal entity behind Signal) does not know what groups you’re in, does not know who’s in your contact list, does not know which groups you are sending messages to, doesn’t know which groups exist, and can’t tell the difference between a message, a reaction, a read receipt, a remote delete (“delete for everyone”), an edit… etc. Signal doesn’t have a way to send anything between two parties that the server can see. Signal has received a number of subpoenas which they typically fight, and if/when they lose they over all of the information they have about the subject of the subpoena, which tends to be whether or not they have a Signal account, when they registered the account and when they last used it. You can see these at signal.org/bigbrother/
Matrix (as in the Matrix server you’re registered on as well as the servers of whoever you’re talking to, for groups that means everyone in the group, notably this is not necessarily the same as the legal entity behind Matrix, but in practice a LOT of people use matrix.org for their home server so it frequently is) can see basically all of the things I listed above. The text of normal messages is encrypted. The group membership list isn’t encrypted. reactions aren’t encrypted. read receipts aren’t encrypted. Group membership lists are stored in plain text.
gelberhut@lemdro.id 1 year ago
Well, matrix, does not require your phone. You, theoretically, can selfhost a matrix server.
On the other hand, one can say that signal provides same level of e2e encryption and protection as WhatsApp, right?
poop@lemmy.blahaj.zone 1 year ago
“theoretically” being the operative word here. Most people don’t. And if they did, they wouldn’t be able to talk to anyone else without the metadata getting copied to that person’s server. Probably okay if it’s between two information security experts who operate their secure own servers, but in reality most people don’t do that. This could be summarized as: Matrix offers a lot of easy ways to be less secure, Signal does not.
As for WhatsApp, I know they have paid or maybe still do pay Signal for their encryption. I believe Facebook Messenger did or does as well. I’m not sure what the actual implementation looks like and neither is anyone else, because it’s closed source.
floofloof@lemmy.ca 1 year ago
Matrix offers the same level of end to end encryption as Facebook Messenger
Can you please explain that in a bit more detail, for those of us who use these systems but aren’t up on the architecture?
poop@lemmy.blahaj.zone 1 year ago
Facebook Messenger offers optional end to end encryption just like Matrix. Just like Matrix, the server knows who you’re talking to, what groups your in, who else is in those groups, how many messages you sent to which group, who’s messages you react to, etc. But the actual text of the message is technically encrypted so Facebook can’t respond to subpoenas for your messages. I use Facebook Messenger as an example because Facebook is (correctly) generally considered not private or safe.
noodlejetski@geddit.social 1 year ago
they’ve been pretty clear in the past about their lack of interest in decentralisation.
if you want to see what a decentralized, private messenger looks like, try Matrix.
mossy_capivara@midwest.social 1 year ago
Yeah I’ve really interested in it just haven’t made the leap yet
philip_the3rd@kbin.social 1 year ago
Thank you, I'll probably keep Signal away from it, buy WhatsApp and SMS hoover my metadata anyway, so nothing to lose there.
mossy_capivara@midwest.social 1 year ago
Giveneveryonees advice, I’ll look into matrix
ebc@lemmy.ca 1 year ago
Signal had something good when it could simply be your default messaging app on your phone, and it’d transparently send either encrypted messages, or plain-text SMS. Now that they’ve removed SMS, they’ve just turned into a worse Whatsapp (because nobody is on it). Network effects are important in messaging apps.
mossy_capivara@midwest.social 1 year ago
Trust me I know, having my whole family try it out and then have them pull that later was a punch in the face
sarsaparilyptus@discuss.online 1 year ago
Was that the punch in the face, or was it all the morons intentionally misinterpreting this argument and saying “but why would u want to send nonsecure messages are you aware SMS isn’t secure it’s like so insecure to send SMS bro it’s not secure it’s like literally a security risk bro SMS isn’t secure at all and also are you aware SMS security is poor”
Encode1307@lemm.ee 1 year ago
Same here. It’s pretty frustrating.
brill@lemmy.world 1 year ago
My family still uses it vs texting. We like the video calls as well. :)
DarkThoughts@kbin.social 1 year ago
I don't see the issue? Just use your native messenger for SMS. Why does it need to be part of Signal? It just makes things convoluted and confusing to have an unsecure messaging service inside an otherwise secure messaging app.
Steve@compuverse.uk 1 year ago
This always struck me as strange thinking.__ Are most people really unable to understand use different messengers with different contexts and groups?
Honestly I use a few myself. My job has Tiger Connect. I use Signal with all my family and friends. Then I use SMS for some companies automatic notifications. It’s pretty simple and easy.
ebc@lemmy.ca 1 year ago
Well, yes. But when all your friends are already on Facebook Messenger, good luck getting them to install Signal only to talk with you. Network effects are important; a messaging app has no use when you have nobody to message on the app. Supporting SMS was taking advantage of its network effect, and I don’t think their network was big enough to be self-sustaining for most users (it wasn’t in my case, my only contact in there is my wife).
NENathaniel@lemmy.film 1 year ago
I’ve just kinda made anyone I message regularly message me on Signal or Telegram. Fuck Meta 🤷