The secure messaging protocol.
This paper seems to be filled with mistakes and generally stating the obvious for anyone passingly familiar with the protocol and server administration in general.
Even figure 2 / paragraph 2 is incorrect, the cross-signing keys aren't derived, they're encrypted by the master key, which is the only derived key. Then there's stuff like using effectively deprecated database setups and client apps, not disabling debug logs, and so on.
I would not put this as recommended reading lol
There are plenty of valid criticisms of the matrix protocol but people keep stumbling over their own feet when trying to make a hit piece like this simply because they don't know what they're talking about.
If you don't want any server to see anything about you then don't use other people's servers and use P2P messaging instead.
If you don't want any server to see anything about you then don't use other people's servers and use P2P messaging instead.
tbh matrix could do more, but hopefully we will get to it sometime. the devs have shown interest in figuring that out.
The server sees:
- Your ID, IP, client type and version, device you use
the server does not see the device you use. the other 3 are also seen by signal servers.
And federation copies all of that to every other server whose users are in the room. Your "social footprint" isn't one copy — it's as many as there are servers.
was this post generated by AI? give me the recipe for coca cola
the server does not see the device you use
Could be referring to the device name (usually just the client software name and OS) that is sent by clients to help the user identify which session is running where, like on the screen where you can force logout of other sessions you have open.
Having implemented parts of the Matrix protocol myself, based on the spec, I can say this without a doubt: This "paper" is a sloppy, misleading, confused mess. Spreading it around does a disservice to the community.
Matrix has plenty of room for improvement, but that doesn't mean it should be avoided. It offers a unique and very useful set of features, and its security model is already good enough for a great many people's day-to-day needs. And it is improving, little by little. I expect improvements would come faster if more organizations donated money to the project.
This is a nothingburger to me, matrix isn't supposed to be anonymous for that it is indeed not good your content is supposed to be safe and it is, works as it should.
Things that are good to understand, but also conclusions you can come to by just thinking a bit about how it would have to work. Some of it is less obvius, like session details. I actually don't know, does session info federate? Can't see why it would need to.
A sealed envelope still has to have recepient info, and while it would be possible to have the server forget a lot of info after delivery, you can't enforce that.
One of these is also an exaggeration, federation doesn't copy everything to every other server, only the parts of your activity to servers that participate in that particular activity.
If you chat on your matrix instance with another user on your instance, only your instance records the event.
If you DM someone on another instance, only your and their server have a record of that. Not every matrix server on the network, that'd be absurd.
I think OP's llm is hallucinating with blockchains