Submitted 8 months ago by tothedaring@kolektiva.social to privacyguides@lemmy.one
still hella confused as to why self-proclaimed privacy advocates—even teams like @privacyguides—are pushing @element so hard despite the data collection & sharing practices, the loosey-goosey metadata usage, and the fact that they host on AWS.
they host on AWS
You’re supposed to host on whatever you want.
data collection & sharing practices
Fork it if you want, remove what troubles you.
Of course, as soon as two people take this advice and then attempt to communicate, we have reached the standoff, where One of the two people must swear off their data sovereignty.
What is your idea to solve this?
With centralized messaging services, both of them must swear off their data sovereignty.
While with true peer to peer systems none of them must do that, that model is not really compatible with mobile devices as both the sender and the receiver has to be online at the same time for the message to go through, and generally any device that is not online 24/7, which mostly includes all desktop PCs.
For this reason, I think that for the average user (who does not have a 24/7 online server-role machine, or maybe even a desktop computer) the best solution is to choose a server operator who they trust with their data. Or, they may try to run a lightweight homeserver on their mobile device (laptop or even smartphone), and live with it’s shortcomings. Not like it’s not possible, and this way everyone can register where they want, including their own part-time server if they are more comfortable that way.
However I think I did not totally understand what is your exact concern.
Do you think it to be a problem that even if you run your own server, messages you sent to your friend on another one will be stored on that homeserver too?
If so, I don’t think it’s possible to solve that problem. They (your friend) have chosen to take a compromise between security and ease of use by trusting someone else with storage. You can’t tell them - only suggest - where should they store their data, otherwise they would lose their sovereignty over it.
Fortunately confidentiality can be kept with encryption, and if you are concerned with the other server having access to metadata, you could patch your server to try to generalize the message metadata to some extent, like with delaying sending messages to they 10th minute and such measures.
xmpp with omemo hasn’t been mentioned but I would be perfectly happy if we all switched to that
The only thing a regular person will do on element is lose their key and cry softly into a pillow.
And at that point it was just working like Signal does. Right?
New users should be told that they won’t have access to their old messages, just like with signal, unless they do a one-time additional setup.
This really should be exclaimed at the beginning on every chat history in every major client, because it is not obvious, and as you said users only realize when the damage was already done, or not even then.
What about IRC or darkirc?
XMPP+OMEMO
sp6@lemmy.world 8 months ago
Element isn’t perfect, but what’s a better alternative? A giant Signal group would be a horrible idea, since everyone’s phone numbers would be exposed to the other members (plus there’s a 150 group member limit), and Discord is obviously much worse than Element (from a privacy perspective).