cross-posted from: https://lemmy.world/post/2077535

I’m not sure if it is entirely accurate to compare them in this way, as “Matrix” refers to simply the protocol, whereas “Signal” could refer to the applications, server, and protocol. That being said, is there any fundamental difference in how the Matrix ecosystem of federated servers, and independently developed applications compares to that of Signal that would make it less secure, overall, to use?

The most obvious security vulnerability that I can think of is that the person you are communicating with (or, conceivably, oneself, as well) is using an insecure/compromised application that may be leaking information. I would assume that the underlying encryption of the data is rather trustworthy, and the added censorship resistance of federating the servers is a big plus. However, I do wonder if there are any issues with extra metadata generation, or usage tracking that could be seen as an opsec vulnerability for an individual. Signal, somewhat famously, when subpoenaed to hand over data, can only hand over the date that the account was created, and the last time it was used. What would happen if the authorities go after a Matrix user? What information about that user would they be able to gather?

  • lmk
    10•1 year ago

    Homeserver admins (of all homeservers that federate given Matrix room) can see who (meaning: Matrix user id) you’ve talked to and when it happened. They cannot access the content of the messages itself, as it is protected by E2EE.

    Matrix P2P has been proposed to circumvent this issue (by embedding a local Matrix server within the client), but I have not yet seen it “in the wild”.

    • @KalciferOP
      4•1 year ago

      Homeserver admins (…) can see who (…) you’ve talked to and when it happened.

      I’m assuming that since it is federeated, even if one server was very diligent with not keeping such metatadata, the issue would still remain with the other server if it did not follow the same practices?

      • @[email protected]
        6•1 year ago

        That’s about right. The matrix protocol, while quite big on protecting messages, is not quite so worried about the metadata. This can be minimized if both users are from the same server.

        Whether the metadata leakage is important depends largely on your threat environment.

        As for Signal not having anything to be able to hand over… I’m not sure I take them at their word. That may just be me though, I’m a distrusting bastard.