Hacker News new | ask | show | jobs
by dkasak 1356 days ago
It's true Matrix today doesn't implement end-to-end auth for room control messages, but it's a bit of a stretch to say you can spy on conversations in this way.

In a room where participants are verified with each other, you'd be warned of this with a loud red shield with an exclamation mark in the room header. Additionally, if you're extra worried about a room, there's a "Never send encrypted messages to unverified sessions in this room from this session" setting you can flip in the Element clients.

That said, this can and will be improved in the future, by signing room state events and implementing TOFU (trust-on-first-use) for user identities, so that you can have a large amount of protection even before you perform manual verification with other users.
1 comments
dodgerdan 1356 days ago
> In a room where participants are verified with each other, you'd be warned of this with a loud red shield with an exclamation mark in the room header.

Really? Are you sure there would be this banner in the case of a malicious device being added to an existing user in the room rather than a malicious user?

link
throwawayKiwi9 1356 days ago
Yes, Element is very loud about unverified device participants in an encrypted room.
link
martinralbrecht 1356 days ago
Indeed:

> While the Matrix specification does not require a mitigation of this behaviour, when a user is added to a room, Element will display this as an event in the timeline. Thus, to users of Element this is detectable. However, such a detection requires careful manual membership list inspection from users and to participants, this event appears as a legitimate group membership event. In particular, in sufficiently big rooms such an event is likely to go unnoticed by users.

https://nebuchadnezzar-megolm.github.io/

link
throwawayKiwi9 1356 days ago
Looks like it would only be "likely to go unnoticed" for users that regularly disregard the massive annoying warnings about unverified devices and don't enforce verification
link
tptacek 1356 days ago
No: https://news.ycombinator.com/item?id=33018068
link
throwawayKiwi9 1355 days ago
Yes? https://news.ycombinator.com/item?id=33024640
link