paper-research-privacy-matrix.org

Dear HN, We are a small community server, providing infrastructure for a handful of local projects in our town. We are looking for a messenger platform/protocol that - can be selfhosted - doesn't violate users privacy - enforces E2EE - has a UX userfriendly enough for non-tech users - offers groups w/ +100 members - if possible, offers "modern" featuers (chat-history, VoIP, typing indicators, etc.) Matrix is being disussed, but we have serious privacy-concerns. [1] XMPP is being discussed, but people are afraid that the jungle of clients wont talk together.[2] What are your experience with on-boarding non-tech people to modern XMPP-cliens? Is it doable or too much of a struggle? --- [1] "Notes on privacy and data collection of Matrix.org" https://github.com/libremonde-org/paper-research-privacy-matrix.org/blob/master/pa… [2]

https://web.archive.org/web/20210804205638/https://serpentse... https://hackea.org/notas/matrix.html https://github.com/libremonde-org/paper-research-privacy-mat...

Not sure what exactly they were referring to, but here are some of them: https://github.com/libremonde-org/paper-research-privacy-mat...

While the post itself comes off as a bit rambling the mentioned research from a third party is mildly interesting: https://github.com/libremonde-org/paper-research-privacy-mat...

The only section that doesn't end with "we suspect foul play but did not investigate" is a citation of [1], so might as well read that instead. [1]: https://github.com/libremonde-org/paper-research-privacy-mat...

Maybe now it's time to refresh the research papers on Matrix/Riot privacy concerns. After reading these a few months back, I wasn't so sure anymore that Matrix/Riot is what I can wholehartedly trust: https://github.com/libremonde-org/paper-research-privacy-mat...

I can only be happy to see that the research we made and the documents [1] we produced some months back have lead to changes that improve privacy in Matrix. It is a huge win for our nonprofit Libre Monde [2]. We are especially happy to see you will now be lawfully processing GDPR Access requests by keeping the scope tight, and no longer include the full account history, confirming our statements in the Part 2 of the research that it was indeed unlawful to do so, and will inform the ICO accordingly. Hopefully the remaining points in terms of privacy will be addressed! [1] https://github.com/libremonde-org/paper-research-privacy-mat... [2] https://www.libremonde.org/