The biggest issue with Matrix is that the server collects ALL the metadata.
-
-
-
Their github releases have the apk available so you can manually download it and install it or use obtainium.
-
-
I absolutely love Element X. Synapse has been low maintenance to self-host, as well. Win-win.
-
Mobile data you pay a service provider for and link all of your information to ( address, name, etc ), and can be used by one company to track your location at any time with very high accuracy as long as you are near 3 cell towers. Public wifi gets no information about you other than your MAC address and that you're currently within it's range. There is no central body that can track all your movements. You could, theoretically, buy prepaid data plans to minimize the info they know about you, but then you have to buy a new one each month, and there's STILL one company tracking all your movements each month, though they don't really know who YOU are. They could still do traffic analysis to figure that out.
It's not that it's less secure, it's that it's worse for privacy.
Also, messaging over SMS / MMS is awful for security, which I lump in with the rest of this conversation. https://youtu.be/wVyu7NB7W6Y
-
Huh I didn't know this existed. Will compare it to mine later
-
Oh that's the only one I know of. I thought that this is what you're referring to.
-
-
Have you been using this one?
I tried it out once, but I currently don't use it, because I just run mollysocket on my own server.
On my app I don’t get rich notifications only “you may have a new message”.
That should only be the case while your Molly database is locked, because the actual messages can't be decrypted, so no message preview can be shown in the notification.
-
The point is that since Signal's default, well-supported installations use Google services, those services are present on most of your contacts' devices. You might have the knowledge, skill, and motivation to avoid those services on your own device, but since they're still present at the other end of most chats, you haven't escaped them.
It's also worth noting that E2EE doesn't protect the endpionts, and that Google Play Services run with system-level privileges.
-
Indeed. Tucked away in a corner of their web site, where it isn't easy to find unless someone else guides you to it, below a large bold warning that discourages people from actually using it:
Danger zone
Advanced users with special needs can download the Signal APK directly. Most users should not do this under normal circumstances.
This ensures that nearly nobody uses that build. Consequently, almost all chats on Signal will have an app store build running on at least one endpoint.
-
Signal’s default, well-supported installations use Google services
Signal only uses FCM for notifications, with a fallback mechanism (WebSockets) being available in all builds of the app, as well as Google Maps for location sharing (which most people probably don't use anyway).
so unless you’re an extremely atypical user, those services are present on most of your contacts’ devices
Google Play services being present on people's devices has nothing to do with Signal including the library. They are present on almost every Android device, because Google pressures OEMs to include them and grant them system level privileges.
Let’s also remember that E2EE doesn’t protect the endpionts
Yeah, but that's the case with EVERY messenger app, so I really don't know what your point is here?
-
below a large bold warning that discourages people from actually using it
Yeah, because an APK downloaded from the web isn't automatically verified. You need to perform the verification of the package manually, which most users probably won't do. So it's safer to download a build from the Play Store, which does this automatically in the background.
