this post was submitted on 28 Sep 2022
1 points (100.0% liked)

Matrix

3238 readers
1 users here now

An open network for secure, decentralized communication

founded 4 years ago
MODERATORS
k_o_t@lemmy.ml
1
E2EE vulnerabilities in matrix-js-sdk, matrix-ios-sdk and matrix-android-sdk2: if you use Element or (matrix.org)
submitted 2 years ago by cypherpunks@lemmy.ml to c/matrix@lemmy.ml
7 comments fedilink hide all child comments
top 7 comments
sorted by: hot top controversial new old
[–] poVoq@slrpnk.net 1 points 2 years ago

https://nebuchadnezzar-megolm.github.io/

Original paper.

[–] Ninmi@sopuli.xyz 1 points 2 years ago (1 children)

Again.

[–] poVoq@slrpnk.net 1 points 2 years ago

And again in a part that they added to make e2ee more convenient for users that are only security LARPing anyways.

[–] catfluoride@mastodon.social 1 points 2 years ago

@cypherpunks waiting for @fdroidorg to push updates...

[–] jonesv@lemmy.ml 1 points 2 years ago

As far as I am concerned, I use Matrix as a replacement for Slack/Discord/IRC, where I absolutely don't count on e2ee. And Matrix does that really well. For e2ee direct messaging, I use alternatives like Signal or Threema.

[–] sexy_peach@feddit.de 1 points 2 years ago (1 children)

How does XMPP with omemo handle these situations?

[–] poVoq@slrpnk.net 1 points 2 years ago* (last edited 2 years ago)

AFAIK they don't exist because OMEMO keys are device and not account specific, so this entire class of attack surface does not exist.