Comment by twicetwice | Hacker News Reader

Comment by twicetwice | Hacker News Reader

Parent Full thread

I want to voice strong agreement with kevincox. I use an encrypted Matrix room daily and had no idea that reactions, relations (does that mean that edits are in cleartext??), etc are completely unencrypted. I've read a little bit of the spec (though clearly not very much), I've written a bot, I've patched the Element desktop client, I've even been working with a JSON export of my message history and didn't notice—perhaps I should have, but my point is that it's not obvious at all, and users SHOULD be proactively made aware of what's encrypted and what's not.

Sending things unencrypted that users have every reason to think are encrypted is extremely irresponsible. And I assumed, as I think is perfectly reasonable, that everything in an E2EE room is in fact end-to-end encrypted. I'm very disappointed to find out this way that it's not (and won't be for the foreseeable future), and I don't see any justification for failing to making users aware of that.

All that said, I love Matrix, will continue to use it every day, and am hugely rooting for the success of the project. Thanks for all your hard work on it!

Is it really that surprising that the act of reacting to a message with an emoji isn't E2EE, given the server needs to count the number of reactions? One could encrypt the emoji itself, but it doesn't seem like a massively sensitive datapoint in its own right. (That said, we will encrypt them eventually, but it's just not very high priority given the fact it doesn't practically feel very high impact, relative to all the other things we could be doing to improve Matrix).

It is. The expectation in an E2EE room is that everything that happens there is E2EE.

Breaking this expectation is a massive red flag, particularly because Matrix is often chosen with this expectation at the core of the decision.

Just chiming in as a plus one updoot etc. here. I understand the balance of complexity and resources needed to make essentially meaningless data encrypted, and I fall firmly on the side of "do it anyway". I can explain to users that things take longer because they're encrypted, I can't explain to them why they have general sentiment analysis derived from emojis used over time intercepted by <X> in a room they thought was secured.

> Is it really that surprising that the act of reacting to a message with an emoji isn't E2EE, given the server needs to count the number of reactions?

Why couldn't the client simply count the number of reactions?

I can't imagine it'd be a performance issue. After all, if you didn't have reactions you'd have a bunch of in-band "+ 1" comments; if such a thing would bring down the server then I'd assume you'd have much bigger problems.

Edit: clarification

Yes, this is very surprising to me. I would've thought that all stuff I do in chat is end-to-end encrypted.

Is this not the case for e.g. Signal reactions?

If communications are generally encrypted then that absolutely is surprising. In that example all the clients could be counting the emoji bs or whatever individually without any server even being aware of the message content.

> relations (does that mean that edits are in cleartext??), etc are completely unencrypted.

The text/content of the edit itself is actually encrypted, you can check in Element by viewing the event in de/encrypted form

Reply on news.ycombinator.com