paper-research-privacy-matrix.org VS simplex-chat

I am trying to find something similar to discord that is actually private. Matrix phones home with a nasty amount of info: https://github.com/libremonde-org/paper-research-privacy-matrix.org/tree/master/part1, Snikket seems like a decent alternative, i just havent audited it for security purposes. Any suggestions? All im trying to maintain is the multiple-channels aspect of Discord, voice/video are optional, but preferred if possible

I present to you a MUC I've created on the XMPP (also informally known as Jabber) network. I've put some thought into which network would be best fit and decided that, while IRC is an excellent way to chat, there is an apparent lack of mobile support and perhaps lacks the ability to choose a server of your choice. Furthermore, I've concluded for many years that Matrix isn't a good choice for multiple concerning reasons, the most impactful being the Matrix Foundation itself receiving large amounts of metadata and being overly centralized over the entirety of the network. Matrix also utilizes CloudFlare (a popular CDN service) which, according to W3Techs, provides services for 19.2% of all websites. I don't believe CloudFlare is a bad actor but they certainly can MITM any websites utilizing their free tier plan. One can easily check if a website is using the free tier SSL certificate by checking here. You can see that in the "subject" area, it shows the SSL domain name as sni.cloudflaressl.com. CloudFlare's free SSL operates by encrypting only the data sent from you to the CDN, leaving the data that is sent from the CDN back to Matrix.org unencrypted. This isn't necessarily problematic for the entirety of the network, however, it shows the Matrix Foundation has an apparent lack of privacy/security practices while advertising their project as a privacy-oriented chat solution. I won't ramble on too much about Matrix's suspected privacy issues, instead, I'll leave you these two write-ups to read for yourself, here and here.

it's an entire paper written by a nonprofit dedicated to user privacy. it's also last updated 6 months ago? you can view all the commits here (https://github.com/libremonde-org/paper-research-privacy-matrix.org/commits/master)

I found this to be an interesting read about Matrix. https://github.com/libremonde-org/paper-research-privacy-matrix.org/blob/master/part2/README.md

Not sure what exactly they were referring to, but here are some of them: https://github.com/libremonde-org/paper-research-privacy-mat...

For messaging I'm currently on Olvid (E2E with physical key exchange) but since it still use their servers, I'm currently testing SimpleX where I can host my own servers.

Notice how SimpleX (https://simplex.chat/) has no push notifications by default because of this issue.

I've been using SimpleX [0] with a couple of friends recently. It appears to work as advertised.

[0] https://simplex.chat

If you have a mobile phone number, the domestic intelligence agency knows exactly where you are at all times and any LEO (without a warrant) can also find you. In addition, there have been numerous CCC presentations showing how insecure the global (excluding US) and (separately) US carriers are guilty of promiscuous metadata trafficking ($$) and insecure SS7 setups. As a consequence, for low $, you can go to any one of several shady websites and find the last location of almost any phone number (person unique ID) globally. There are additional varying exploitable vulnerabilities depending on the exact combination of {handset x carrier x country} to impersonate them, tap their line, reveal their exact location, and redirect their phone number through a third-party handset or even a PBX. These are more expensive and some capabilities are forbidden for all but a few selective intelligence uses.

Session (Signal fork) doesn't use phone numbers. It's pretty well-designed overall and uses an onion routing approach. It's already a superset of Signal except it doesn't use phone numbers. https://getsession.org

Also look interesting:

* (unproven) https://www.olvid.io/technology

* (unproven) https://simplex.chat

PS: Using regular TOR on home broadband or cloud servers is relatively risky and inefficient. Sybil attacks on it are common. And to network operators and security agencies it gives an easy "flow tag" of your uplink and exit node data traffic as automatically suspicious.

Why not open up a Feature request on https://github.com/simplex-chat/simplex-chat/issues