Hacker News Reader

Comment by jeroenhd | Hacker News Reader

I just tried logging in to Element.io with an account on my own homeserver and I saw several requests to vector.im before the privacy policy popup, including what seems to be some kind of token exchange.

I don't think the intent is malicious, but the system is definitely leaky. My homeserver config doesn't mention vector.im (perhaps it's a hidden default somewhere?), I checked.

From a protocol standpoint, no identity server is necessary. From a practical endpoint, all feature-rich clients (the ones I know support e2ee) seem to send requests to vector.im. Matrix is decentralized, but a lot of data still seems to get leaked to a centralized place by accident from my short experiments. It's not a great scenario, even if I'm fine with a few requests to the 3PID server every now and then.

Client issues are ecosystem issues if all usable clients suffer from them.

View on HN

> I don't think the intent is malicious, but the system is definitely leaky. My homeserver config doesn't mention vector.im (perhaps it's a hidden default somewhere?), I checked.

IIRC, identity server is something primarily set on the client (element.io here) rather than the homeserver.

It really needn’t and shouldn’t ping an identity server as part of the sign-in process (esp before/without privacy policy agreement)

FWIW it seems the issue is that there’s a fallback process for identity server; if neither your account nor your homeserver has one set, it defaults to the client default. if you host your own Element-web instance you can change this.

https://github.com/vector-im/element-web/blob/develop/docs/c...

Or check out ma1sd. You don’t need to enable all the bells and whistles if you don’t want to.

So I've just double-checked this by opening https://app.element.io in an incognito tab and looking at the network inspector. What I see is what I was referring to in the grandparent as:

* Element has to query your server to find out what authentication mechanisms are available before you log in. Therefore if its config points to the default matrix.org homeserver, you end up pinging that every time you log in, even if your homeserver is elsewhere. The solution for now is to change your default homeserver in the config to avoid this.

The same applies to the identity lookup server as well as the homeserver: the app checks the one in your config to ensure that it exists before the user tries to log in on it. It does this with a single request (a GET to https://vector.im/_matrix/identity/api/v1). There is no token exchange there.

The workaround is to configure the app with the correct default homeserver & identity server (if any) for your deployment. The underlying bug (i.e. don't validate the config until the user tries to log in) is https://github.com/vector-im/element-web/issues/11655, and it simply hasn't got to the top of the list yet; we've been focusing on narrowing the UX gap between Element & Discord/Slack/Teams rather than reimplementing the login flows. As you can see on the bug, it's been picked up off the backlog 9 days ago and is currently being worked on.

Separately, I'm seeing a related bug that Element Web's guest mode is incorrectly kicking in on the login page. Guest mode exists so you can deeplink straight to something like https://app.element.io/#/room/#matrix-dev:matrix.org and read scrollback without needing to register an account - but it looks like we're spinning up guests on the default homeserver needlessly on the login page. This is https://github.com/vector-im/element-web/issues/11533, and we've put it on the radar too.

TL;DR: this is slightly leaky, but is it really any different to Chrome's default config loading up Google as a default homepage? Or Firefox loading up Mozilla.org? Or Thunderbird loading up Thunderbird.org? Eitherway, we'll fix the behaviour, but PLEASE understand that this is a million miles away from the bogus "central authority can have influence on another server" smear from the original post.

> TL;DR: this is slightly leaky, but is it really any different to Chrome's default config loading up Google as a default homepage? Or Firefox loading up Mozilla.org? Or Thunderbird loading up Thunderbird.org? Eitherway, we'll fix the behaviour, but PLEASE understand that this is a million miles away from the bogus "central authority can have influence on another server" smear from the original post.

I understand the whole "central server" stuff is bogus.

However, I consider the forced homepage opens every browser seems to do today an invasion of my privacy, especially with the way these pages often includes trackers. Mozilla is especially bad at this; I've had to disable checkboxes on all my devices to make sure I don't get their stupid VPN ad, which is tracked with Google analytics and which addons can't properly touch because certain Mozilla domains are exempt from addons (rightfully so!).

Google knows when I open Thunderbird. Google knows when I update Firefox. Google knows when I do anything in Chrome. Microsoft tracks even more than Facebook when I accidentally open Edge because I was foolish enough to click on a help icon in Windows 11. Element knows when I log in to Matrix. All of this data collection is completely unnecessary, and while this comes from a sick hunger for data in Mozilla's/Google's/Microsoft's cases and a configuration quirk in Element's case, it's still a worrying development in my opinion.

I know you folks are working hard to fix things like these and I originally wanted to call balogne on the claims several people made in these threads, but I couldn't because their observations about the identity server were right (though their conclusions were strongly overstated).

I'm glad that this is on your radar and I'll happily keep using Matrix while this is being fixed in the background, so don't get me wrong here. I love Matrix and the possibilities it represents, and I hope the clients and features will continue maturing so that I can recommend my friends and family to get it.

Reply on news.ycombinator.com