Hacker News new | ask | show | jobs
by storrgie 2063 days ago
not the _identity_ servers currently though.
2 comments

Yes, but it should be noted identity servers are only used for associating phone numbers and email addresses to Matrix IDs. Matrix IDs themselves are federated just like email addresses (@cyphar:cyphar.com is mine, and it's hosted on my own homeserver at cyphar.com).

If you don't register your phone number or email address (which last I checked is not part of the default account creation flow) then it really makes no difference. I agree they should be federated (and they have been working on that among many other things) but it's not like every user's identity is centralised.

I have run my own identity servers for private deployments without issue.

This is, granted, not as easy as it should be, but it is an issue the matrix team is working on improving.

You also don't need to use the identity service at all. It is totally optional for user discovery.

Third party implementations of the identity server already exist too.

Someone could even write their own replacement that uses SGX if they really wanted ;)

Optional security isn't security. Especially with the sort of metadata that is in _someone else's phone_. Basically, everybody who has my phone number probably has it in their iOS/Android contacts. I can't opt out of _them_ using a bad identity server.
But you already can't opt out of them sharing their entire address book with the latest sketchy app they downloaded. What's the difference?

They either have your phone number and other contact details in their phone or they don't. They either make good decisions or they don't. You choose how much to trust them and what with. Federation and third party implementations of identity servers for one particular app changes absolutely none of that.