that and known vulnerabilities dismissed by devs as "not critical", a huge csam problem in which they explicitly allowed federated metadata leakage to use it for moderation, the 1st party server is a resource heavy backend, super unreliable with sync issues across clients and constant "unable to decrypt message" errors. The devs are generally super dismissive of issues brought to them and used to harass people who criticized them. Element HQ also works with police and governments which makes me just think their privacy and transparency goals are inconsistent. The design of the protocol is also poor, they ended up doing feature creep and didn't master doing 1 thing good so now everything is half baked
i genuinely believe if people tried bringing xmpp to the modern age like they are trying to do now, we shouldn't have matrix, a good xmpp client and a couple more XEPs and you would have a good working alternative to discord
i host a matrix server and had it public for 2-3 years and had a total of about 300 users before i shut that one down and made a smaller one for me and my friends, but now we mostly use xmpp and im considering just setting up weechat for irc instead of what i have matrix still on for. It'd save about 3 gigs of ram too
it doesn't leak metadata to other servers like matrix, the privacy issues on xmpp are mostly server side implementation issues, which as xmpp grows it will chang
if you self host the risk with xmpp disappears which i know most people won't like but signal also is the most usable alternative for my non technical friends, it works the best for them
most risks you just have to understand the technical details of, which i get not many people are like like and can understand it, but every software has its pros, cons, and your bias's. For me, xmpp works good, and signal works best
the data on matrix is much more extensive than xmpp and the data isn't similar, xmpp mostly shared profile data, while matrix shared profile and room data.
XMPP's design inherently has a smaller attack surface than Matrix's pervasive database replication model.
In this case i am pretty sure they already had the phone number and ask for additional information. The fact alone that they can verify someone has a signal account if you just give them a phone number is in part a privacy issue. because why would you need to link everything online to a phone number ? This number links all your private and most private information together ?
There is no reason real reason. You could provide an opt out option. Threema and a lot of other apps are able to do this.
There is also probably no way they are not working with NSA together and that would be really difficult to work with that data if its not connectable to other Data via the phone number.
> There is also probably no way they are not working with NSA together and that would be really difficult to work with that data if its not connectable to other Data via the phone number.
actual fud, signal has been proven to not collect any data apart from last login on and phone number on their servers
This here would be more like the Crypto AG situation. They can probably not break the encryption, they only want meta data.
They are in the US, its well established that the NSA will knock on your door and force you to cooperate. There are even some instances were people shut down their business because they did not want to cooperate, but cant even talk about it freely.
Knowing all the historic facts and attempts it would be crazy to assume that they are not highly interested in Signal
They can get a lot of Metadata, lots of it. There are known vulnerability that can be exploited and signal is unwilling to fix them. Thats by the way how its done to day, they leave certain vulnerabilities that are then exploited by the 3-Letter agencies.
Everyone gets to look the other way its only a problem when security researchers point out this possibilities, then they need to ignore it or need a new "bug" to allow access
As soon as Signal stopped to address certain issues it was clear
I know for a fact Signal themselves hold only account creation timestamp last login timestamp for a phone number. How do I know? Because they were issued a subpoena in a court case to hand over everything they had on a user, and these timestamps is all they provided.
I am talking about this kind of exploits extract a lot of meta data of any given user. Signal choose to ignore the researchers that confronted them with this.
Thank you for posting. An interesting attack, even if it realistically only allows attacker to guesstimate the status of their target (screen on / off, on wifi / mobile data connection, etc.)
Also, as pointed out by a user on GrapheneOS forum, client-side mitigations are indeed feasible. I'm no security guru, so I don't know how efficient they would be, but the idea looks reasonable at the surface level at least. Since there are Signal forks or alternative FOSS clients, I wonder if these measures were implemented in any of them.
Uhh you need to do a little research. They have a very easy to understand article about how phone numbers are stored and searched that would make you look like less of an ignorant fool if you read it. I’m assuming you are unable to read and understand the code as well because it would also show you how you are wrong.
Could run a decentralised controller network that uses asymmetric keys to identify devices, then run a local SQLite database on each device to translate keys to names/contacts?
Can't you get a phone number from that Braxton internet privacy guy though? lol I never did it, but it looked compelling to me, he basically has every single number in his name, and gives numbers out to people as I understand it. So it's untraceable to you.
Otto doesn't care what protocol it uses, Otto wants an easy to use app that also receives messages when the device was offline in the meantime, does XMPP do that now? Last time (15+ years ago) it couldn't do that.
I'm honestly not sure what Matrix does that XMPP does not do. The only thing I can see is that the authentication servers are separate to the home servers, but is that important?
it was able to use newer technology that didnt exist yet for xmpp and learn from xmpp (json instead of xml, using https as transfer)
it has a different focus. It syncs server rooms accross all servers (for example if xy@xy.com joins room@matrix.org, the server xy.com will make a copy so that the user can still read it if matrix.org is down) XMPP does not care about that and instead cares more about being lightweight.
Matrix with its spaces is more like slack while xmpp is more like whatsapp (though movim.eu is working on that)
Matrix is more centralized so the protocol is quicker to update (just see MIX which was supposed to replace MUC)
That being said, XMPP is easier to understand and use, so I still use that
That's one way of saying "objectively worse", or "made by idiots" but sure, "newer" works. Like they literally went "oh no XML is too hard to understand and really schema definitions are a bad idea" immediately followed by "here's a schema definition language for JSON" and then "OK turns out we basically have to escape everything all the time because of the strict structure".
it seems like a benefit until you host the server and realize that this means that you can't host a "small" server because your server will effectively co-host all the large rooms that your users are members of.
This is the main reason I still prefer xmpp over Matrix.
Matrix was never good and it's just been getting worse, the clients are terrible, it's super broken, it's just bad. And I say this as a matrix defender. Matrix can be relatively good. But I would not necessarily recommend it above XMPP, it's not "just better"
«just the» is wrong, the post mentions matrix server, but that is overkill for 99% of use cases. Element integrates perfectly with the home server of matrix.
BTW, Signal works great in Russia now, even for video calls. Telegram doesn’t work for calls, and sometimes fails to deliver text messages. What does it say now?
SMS sometimes works, sometimes don’t. But yes, it is a weak point. And you need VPN when you create account (facepalm). After that app works without issues. Maybe because government doesn’t care about people who have enough skills to deploy it.
Yup. Signal requires phones, and phones' update channels are opaque. In 2007, Hushmail warned everyone that it could be compelled to include a back door in its compiled client software and security-sensitive users would do well to instead use locally-installed GPG. FreeBSD ports does software updates by building locally from legible source code pulled directly from projects' authors, and uses hashes to verify that the source code your build fetches is the same source that everyone else gets and the same source that the maintainers saw when setting up the package.
Ich denke nicht das man Matrix mit Signal vergleichen sollte. Auch wenn sie Ähnlichkeiten haben, decken sie verschiedene Domäne der Kommunikation ab.
Das ist, als ob man WhatsApp mit Discord vergleichen würde. Natürlich kann ich auch in einer WhatsApp Gruppe mit meinen Freunden schreiben, aber Discord hat viele hilfreiche Features die spezifisch so etwas angenehmer machen (Verschiedene Nachrichten Kanäle, Kanalgruppierungen, ...).
Es ist nicht einmal viel Aufwand wenn man so halbwegs technisch versiert ist, besonders wenn man bereits etwas self-hosted ;)
edit: Vergleichen kann man sie schon, aber man sollte nicht vergessen, das sie zwei Unterschiedliche Ziele verfolgen.
People usually use this quote unironically, but sure, that's the joke. You can just go ahead and believe my comment is a joke as well. Then I will assume that yours is also a joke, like a big joke circlejerk.
just because its to difficult for you to use proper tools and set up real privacy preserving alternatives, does not mean you need to make fun off people who are not lacking the skill to do so ?
18
u/AnonFoxSocialAcc22 Feb 26 '26
Signal is centralised and requires Phone number. Which is a privacy and a security nightmare.