Tightening up Privacy in Matrix
matrix.org
matrix.org
I'd much rather personally validate and match my contacts on my own and I really think this should be the default with huge WARNING to people that want to share their email globally and addressbook with the server etc.
"Users don't care" is largely because developers submarine the issues with "UX flow" reasoning.
Excusing this toxic data exfiltration with "UX" really doesn't hold water.
Edit -
Specifically looking at
https://github.com/vector-im/riot-web/issues/10167
This looks like industry standard bury the issue in unreadable TOS boilerplate.
How about "Hey YOU PROBABLY DON'T NEED to share your email globally unless you expect to meet your long lost cousin via the matrix.org social graph"
This is a place where ADDING friction makes the world better.
However, there are then folks hyperfocused on privacy who declare this ‘toxic data exfiltration’ and vociferously object.
We’re trying to get the balance right, and it’s worth noting that the bug you linked is still up in the air. We don’t have the final UX yet, but the idea is to even more explicitly warn the user that their contacts are being uploaded to a identity lookup service if they want to discover people on the network. An alternative/complementary approach is https://github.com/vector-im/riot-web/issues/10093.
(edited due to accidentally hitting submit...)
I use matrix to talk to a few friends and family largely trying to replace gtalk.
The irc or whatsapp usecase isn't really whats up for me.
Sharing the email globally suddenly puts its out there for 7billion other people... you KNOW this is going to get scraped and repurposed, so why do it?
Separate the flows.
1 - "Hey I'm a social butterfly and WANT to add my twitter etc I UNDERSTAND this is blasting my personal data to the world"
2 - "Hey I'd just like to get off gtalk and talk to my close friends and family/creepydarkprivacyspais"
The flows for addressbook alone... like how thought out is any of that? Oh sweet my coworkers from 17 years ago are going to matrix with me...(no thanks?).
You've done a lot of good INNOVATIVE work with matrix so far but this part seems half-baked and frankly like you are phoning it in.
I'm not sure i'd characterise this as phoning it in: the point of the blog post and all the accompanying bugs is to spell out that we're trying to solve for once and for all the problem of how best to enable contact discovery for folks who want it (as opt-in rather than opt-out!)... while also keeping the private-messaging crew happy. Totally agreed that it's been half-baked historically though, which is why we're fixing it now that 1.0 is out the door and we have some bandwidth to address it.
> Separate the flows.
The idea here is absolutely to separate the flows. We don't have a final UI proposal yet (as is clear from the bugs) because we're still working it through. The closest is probably https://github.com/vector-im/riot-web/issues/10091 right now.
The reason I cheer about Matrix is exactly because of its P2P nature, which neither of the other privacy focused solutions like Wire/Signal address (though these give better privacy right now). Isn't it exactly the privacy conscious crowd that matrix is pitching to? Those of us who don't trust a signal or wire server because that server code is proprietary? Matrix has been promising better privacy (and e2e encryption) for some time but maybe this isn't actually where matrix is heading? I sure would like to know because there is no point for many of us to continue cheering for what otherwise looks really promising. And it's not like a better technical solution for the address book doesn't exist!!
I would love to be able to point non-technical users to an email alternative with sane integrity properties, and I've tried to some extent to push correspondence to Riot, but as it is right now, many of those users seem to suffer from Riot's flat design and not adapting well to the room metaphor. And one trigger-happy composition line posted to infinity scroll chat is pretty far from the experience of even a rudmentary email client.
I'll admit I haven't done a thorough search of the clients but if you're aware of good implementations of a letter metaphor for Matrix I'd be very grateful to learn what I've been missing.
However, the other aspect of mail style semantics is the incredible flexibility which email gives in terms of adding/removing people from threads on a message by message basis. This doesn't map very tidily into a Matrix room currently, and is a bit of an open question right now :)
I hope the Matrix equivalent will be able to fully match and outdo email eventually, but 1-on-1 is already enough to be valuable, and it seems to me the room metaphor should be possible to map fairly gracefully to mailing lists at least.
Thanks for the efforts, as always!
I will read up on more of the current capabilities soon, by the way, to see if we can put an society I'm in on Matrix for internal communications and event announcements.
You can see this spelt out in our project manifesto at https://matrix.org/foundation, which says that we believe:
* People should have full control over their own communication.
* People should not be locked into centralised communication silos, but instead be free to pick who they choose to host their communication without limiting who they can reach.
* The ability to converse securely and privately is a basic human right.
* Communication should be available to everyone as a free and open, unencumbered, standard and global network.
You'll note that privacy is in there, but it's not the only thing that guides the project.
> Matrix has been promising better privacy (and e2e encryption) for some time but maybe this isn't actually where matrix is heading?
I assume this is ironic, when commenting on a blogpost talking about how we're improving privacy considerations. Meanwhile, E2E is going great guns, as per https://news.ycombinator.com/item?id=20315096.
> And it's not like a better technical solution for the address book doesn't exist!!
What do you have in mind? The only one I'm aware of is Signal's SGX stuff (https://signal.org/blog/private-contact-discovery/), but there you swap out trust in whoever runs your identity server for trust in Intel, which doesn't necessarily seem like an obvious win.
SGX is just yet another iteration of the 'trusted tamper-proof hardware' concept (which, for reasons that are unclear to me, is apparently magically fine when Intel does it but impossible and bound to be broken when somebody else does it), and it suffers from the exact same issues as every 'trusted hardware' scheme before it.
"like Signal, WhatsApp, Telegram etc and tells you which other users are contactable."
For me that is an anti-feature and something which I have so far never wanted to do. I hate when apps ask me to add users based on my other contact lists. I want to curate my contact list and only add the people I communicate with over this platform. I do not want to add a bunch of old contact's which I have forgot who they are when moving to a new messenger and I do not want to add people's accounts which they may have only used once years ago.
And this is entirely ignoring the privacy aspect of it which I do not care that much about.
This is the same reason why (for instance) E2E isn't the default right now -- there were massive usability issues that most normal users would have trouble with (until very recently you could lose all your historical session keys unless you were very careful and backed them up religiously). Speaking anecdotally, several people I've switched to Matrix really wanted to switch away because they lost all of our old chat messages when they logged out of their account.
I hope you agree that people without very strong privacy concerns should be able to use Matrix as well.
> For me that is an anti-feature and something which I have so far never wanted to do.
This is also true of me. I have no reason to want to know if any of my contacts are available through the messaging app I just downloaded. I downloaded the app because I want to communicate with a particular person or set of people. I already know about them.
These people who would like to know if anyone in their contacts list is available on their new chat app -- why did they download it in the first place?
Most users are already using Signal, WhatsApp, Telegram etc. I don't think it makes sense to sacrifice privacy to make Riot work similarly to them when the whole reason to use Riot is so that you don't have to make such sacrifices.
How does Discord works? It's pretty popular and I don't think they do that. Somehow it doesn't seem to be a problem for them.
Discord is just one specific use case of an app, while Matrix is trying to support all possible ones (e.g. WhatsApp style behaviour).
However there's a broader point that it doesn't make sense to imitate the competition when the thing you're copying is precisely the reason why one would want to leave the competition to your solution.
Also, the Identity servers are part of a closed cluster where data is replicated. We are aware of vector.im and matrix.org but you did not answer the following question of the research document: is there other servers in that closed cluster? If yes, which?
IS lookups are shortly going to require auth, as per the OP (even if just to check whether the API user has agreed to the server’s T&Cs)
There are no other servers in the cluster.
You can add a value to delay in your HN profile. E.g. delay 10 gives you 10 minutes till your comment appears.
See the FAQ, "In my profile, what is delay?" [1]
There are a few problems. First the UI for approving new client connections in encrypted chat rooms is complete crap. It needs to be clear and concise what is happening and currently it starts a super complicated verification process which is frankly confusing.
It simply needs to say "$user has signed in on a new device $deviceName. Is it okay to send messages to this device? Yes/No"
That's it.
Also there needs to be a better way to integrate third party plugins. One thing I miss from Facebook messenger is being able to paste a Spotify link and have the song come up as an embed.
Finally the bot API could use work. I spent some time professionally maintaining a Slack bot for a major American cable company and currently it's much harder to make a Matrix bot and documentation is lacking.
Device cross-signing has nearly landed and will solve this problem by creating a pseudo-WoT between users meaning that you need to do verifications very infrequently (ideally, only once when you first start talking to the user).
> It simply needs to say "$user has signed in on a new device $deviceName. Is it okay to send messages to this device? Yes/No"
Doing it this way would open the door to a malicious homesever (or a user's account being hacked into) being able to eavesdrop on you. Device names aren't cryptographically relevant. Device cross-signing (where a user's devices sign each other) solves the problem in a much safer way.
> Finally the bot API could use work. I spent some time professionally maintaining a Slack bot for a major American cable company and currently it's much harder to make a Matrix bot and documentation is lacking.
This boils down to the fact that bots are basically just normal Matrix clients (with a few extra features if you've set them up as an application service). You might be better served by using a library (like matrix-nio or the Matrix SDKs).
I have no affiliation with the project.
It's good to finally see a reply, and it's good to see you are addressing some of the issues we have highlighted. It's a shame it took a whole research document posted on Hacker News and other websites to start getting your attention. I am personally surprised about this blog entry (and reply to some extend), given that the research doc was labeled as "FUD" by the lead dev.
Now that we have it, and that you answered in a blog post, there is one question we asked several times and that you still did not answer, even in our GDPR data request: Given that the research document clearly highlights that users are totally unaware of how their personal data was collected, how its going to be used, and that they did not given consent (e.g. storing their email addresses for a lookup query mechanism) under EU GDPR: 1. Under which lawful basis do you collect, process and allow others to use such data? 2. Are you going to keep storing/using all the data you have collected using all the methods highlighted in the research doc, or will you purge all that was collected without clear knowledge and consent of the users?