Is using an Matrix account from matrix.org private and secure enough to talk with my family members and people in general?

[engineergaming@feddit.nl]

Yeah, but it is still just one account per number, so it would make managing alts annoying. Not only is the main client (as well as the major unofficial ones, haven't found one that doesn't do that) not support multiacc directly, forcing use of profiles or VMs, but you're also at risk of whoever rents the associated phone number after you deleting the account (that or you could pay a recurring fee just to retain the number, which is just wasteful).

[jaypatelani@lemmy.ml]

Matrix and Simplex is fine but I would recommend Signal for family and friends. Threema is also option but not user friendly for friends and family who wants easy user discovery than sharing userIDs.

[kekmacska@lemmy.zip]

both are good, even Signal. For private conversations, you only need to avoid Telegram and other obvious ones

[mathias@friendica.hellquist.eu]

@Confidant6198

Signal is fine to use. These days I mostly recommend Delta Chat though. Delta Chat is free, encrypted, open source, audited, decentralised & federated in the same way as email is as it literally is email, it just looks like a chat, and it will work almost out of the box for anyone who has an email address (which is most people). This includes gmail/icloud/outlook etc. There are also chatmail servers you can sign up on if you'd prefer that.

It is no more complicated to configure than it is to configure any other email client. It has group chats, you can even share applications in the chat such as playing games or collaborate etc, all within the security of knowing your email provider can not read your conversations, whilst you still get the benefit of using the existing infrastructure of email.

Check it out: delta.chat/en/

PS. I'm not affiliated with them in any way. In fact, I have no idea if/how they make money. The service "just works" though.

PPS. They are also present in the Fediverse at @delta

[comfy@lemmy.ml]

Private against who?

Privacy communities need to really drill in the idea of threat models instead of pretending privacy is some linear scale and the ultimate goal is to bury your phone and computer in a lead-lined concrete block underground. Privacy and security are meaningless concepts unless you know who your are protecting it from and what their capabilities might be. I don't need to hide from NSA Tailored Access Operations because I'm not trying to x the y of the USA. I do need to protect myself from basic scam attackers, copyright trolls and neo-nazi stalkers. And Matrix, along with certain basic opsec guidelines, does that and more for me.

[zerush@lemmy.ml]

Matrix/Element is pretty private, but not wide spreaded. For the use with friends and Family is more realisticto use Signal or any other decentralized Chat.

[toastal@lemmy.ml]

Matrix.org is centralized like Signal (you can say Matrix is not centralized on paper, but in practice this isn’t remotely true). Both are stockpiling metadata in the West… what’s worse is Matrix’s eventual consistency model means syncing metadata to all servers is a by-design requirement (& also why all servers & clients are slow). There are options like Snikket to take all the hard parts of self-hosting out of the equation, but finding someone you can trust to host a server might be worthwhile. I would be wary of anything centralized.

[toastal@lemmy.ml]

Matrix is centralized too in practice … & syncs even more metadata than Signal so I wouldn’t call that an upgrade—especially when you see how slow the clients & servers are.

[toastal@lemmy.ml]

It’s worth following the project but it’s a bit too new & the funding aspect leads me to question how it will work in the long run (& being written in Haskell is neat, but boy does it have a lot of churn & maintenance issues in its ecosystem).

[toastal@lemmy.ml]

OMEMO is a mixed bag. Some clients are still preferring older versions that aren’t the best for security & almost every client does a bad job explaining that new keys are being used need to be verified… Gajim only recently gave a decent in-client pop-up for it, but it’s doesn’t work all the time. That said, this is basically the same issue Matrix has in the space. Both are based on libsignal if not outright using it, except Signal gets a point of privilege in basically having just one client …one that must be on Android/iOS according to their statements… so they can do a ‘better’ job managing who, what, & how many keys are being used. Many XMPP clients will recommend blind trust by default just because it can be a real hassle to deal with multiple clients & users coming back to less-often-used devices. There have been proposals to fix it, but I haven’t seen anything really take off (meanwhile considering just using the PGP encryption option as less flaky).

[toastal@lemmy.ml]

You’re always here to talk to sense into the folks

[index@sh.itjust.works]

It is not. We are on a privacy sub on lemmy, services that require mandatory phone number are far away from been fine to use.

[toastal@lemmy.ml]

AFAIK, chat.mozilla.org was set up on modular.im, now element.io, which if it still using the same host, is owned by Matrix.org. So even using a different host means Matrix.org might still have your metadata.

[index@sh.itjust.works]

Matrix is centralized too in practice

There are plenty of different available homeservers and you can host yours.

[toastal@lemmy.ml]

It takes 2 to tango. It’s like trying to send an email from a self-hosted email server without following all of Google’s rules/guidelines… which means you won’t be able to send a message to most (sadly). Most folks are either on Matrix.org or a server they host in practice… you alone self-hosting will only help if you only communicate to folks also doing similar… to which if just one user from Matrix.org (or a server they host) joins your chatroom, then literally everything that is being & has been said in that room will now be synced to Matrix.org by its protocol design. With the expense it takes to self-host Matrix for a community, almost all medium-sized communities had to drop it on RAM & storage costs alone which caused most of those users to move to Matrix.org. You can run a single-user host with some efficiency, but most users are not technical enough for this. The only option to use Matrix & keep costs down is to unfederate… at least with Matrix.org (& servers they host), but that now defeats a huge part of the argument those saying Matrix is federated/decentralized.

The accessibility to small–medium-sized communities matters if you want a healthy federated/decentralized network …but luckily there are alternatives.

[index@sh.itjust.works]

It takes 2 to tango. It’s like trying to send an email from a self-hosted email server without following all of Google’s rules/guidelines…

Don't say bullshit, a chat is not mails, matrix federation works similarly to lemmy

[engineergaming@feddit.nl]

Yeah, I agree it has some issues. Personally was fine verifying keys tho - either in-person or wherever I met them (usually IRC).

And yeah, the insistence on mobile in Signal bugs me a lot - a desktop is A LOT easier to make private (Linux runs on damn everything) while most phones won't allow making them not spy due to locked bootloader.

[toastal@lemmy.ml]

DeltaChat literally turns email into something more akin to chat mostly by just changing the UX. Matrix is less like chat tho & more like editing a document & syncing changes with someone but this is besides the point…

Lemmy would have the exact same issue if 90% of users were on Lemmy.ml or servers they hosted, but it is fairly distributed & not as heavy to run (nor does it have some startup mentality behind it trying to ‘disrupt’ chat by inventing new words like “bridges” instead of “gateways” & so on to put off casual users from the scent that chat has a well-worn path development for decentralization since the ’80s)

[toastal@lemmy.ml]

I am just thankful so far that Signal has let WhisperFish exist as an alternative—even if it goes against what they say—which gives me an alternative to the Android/iOS duopoly.

[emberleaf@lemmy.ml]

Can you please provide any data where Signal has been compromised? I'm not saying that the possibility doesn't exist, but I've certainly never seen one single instance where Signal was compromised, so please do share.