I’m not sure if it is entirely accurate to compare them in this way, as “Matrix” refers to simply the protocol, whereas “Signal” could refer to the applications, server, and protocol. That being said, is there any fundamental difference in how the Matrix ecosystem of federated servers, and independently developed applications compares to that of Signal that would make it less secure, overall, to use?

The most obvious security vulnerability that I can think of is that the person you are communicating with (or, conceivably, oneself, as well) is using an insecure/compromised application that may be leaking information. I would assume that the underlying encryption of the data is rather trustworthy, and the added censorship resistance of federating the servers is a big plus. However, I do wonder if there are any issues with extra metadata generation, or usage tracking that could be seen as an opsec vulnerability for an individual. Signal, somewhat famously, when subpoenaed to hand over data, can only hand over the date that the account was created, and the last time it was used. What would happen if the authorities go after a Matrix user? What information about that user would they be able to gather?

  • @KalciferOP
    link
    English
    4
    edit-2
    1 year ago
    1. Would you be able to ellaborate on the following

    matrix stores your profile info

    group membership

    ongoing conversation in plaintext

    As I am not exactly sure what you are referring to.

    1. In addition to metadata that matrix doesn’t encrypt

    I’m assuming that this statement is referring to what was said here:

    On the other hand, matrix stores your profile info, group membership, and ongoing conversation in plaintext, some of them replicated across homeservers

    • @teolan
      link
      English
      31 year ago

      ongoing conversation in plaintext

      This one is incorrect, wording was confusing as hell.

      matrix stores your profile info

      Profile picture and usernames are public, no way to make them private in anyway.

      group membership

      Your home server and the home servers of every other member of the group can tell exactly who is part of the group

      ongoing conversation in plaintext

      I actually meant who and when you send message to and receive messages from.