<story><title>Disclosing E2EE vulnerability in multiple Matrix clients</title><url>https://matrix.org/blog/2021/09/13/vulnerability-disclosure-key-sharing</url></story><parent_chain><item><author>nightpool</author><text>With the recent dust-up around protonmail&amp;#x27;s &amp;quot;end-to-end encryption&amp;quot;, it&amp;#x27;s hard for me to believe that the hammer isn&amp;#x27;t going to come down on Matrix in a similar way. Nobody has seriously turned their attention to the compromised-homeserver issue, even though that&amp;#x27;s the only threat model under which e2ee makes sense. Expecting users in hundred-person group chats to manually verify each other individual user&amp;#x27;s keys is nonsensical. And even a single unverified key means that their homeserver operator could be listening in. I feel like Matrix should move more towards emphasizing how easy it is to self-host and maintain control of your own Matrix data, making e2ee is a non-issue.</text></item></parent_chain><comment><author>Youden</author><text>&amp;gt; I feel like Matrix should move more towards emphasizing how easy it is to self-host and maintain control of your own Matrix data, making e2ee is a non-issue.&lt;p&gt;Matrix is way ahead of you. There&amp;#x27;s ongoing work to build P2P clients [0]. That is, each phone&amp;#x2F;device can be its own home server. The latest update was in May [1].&lt;p&gt;[0]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;matrix.org&amp;#x2F;blog&amp;#x2F;2020&amp;#x2F;06&amp;#x2F;02&amp;#x2F;introducing-p-2-p-matrix&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;matrix.org&amp;#x2F;blog&amp;#x2F;2020&amp;#x2F;06&amp;#x2F;02&amp;#x2F;introducing-p-2-p-matrix&lt;/a&gt;&lt;p&gt;[1]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;matrix.org&amp;#x2F;blog&amp;#x2F;2021&amp;#x2F;05&amp;#x2F;06&amp;#x2F;introducing-the-pinecone-overlay-network&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;matrix.org&amp;#x2F;blog&amp;#x2F;2021&amp;#x2F;05&amp;#x2F;06&amp;#x2F;introducing-the-pinecone-...&lt;/a&gt;</text></comment>
<story><title>Disclosing E2EE vulnerability in multiple Matrix clients</title><url>https://matrix.org/blog/2021/09/13/vulnerability-disclosure-key-sharing</url></story><parent_chain><item><author>nightpool</author><text>With the recent dust-up around protonmail&amp;#x27;s &amp;quot;end-to-end encryption&amp;quot;, it&amp;#x27;s hard for me to believe that the hammer isn&amp;#x27;t going to come down on Matrix in a similar way. Nobody has seriously turned their attention to the compromised-homeserver issue, even though that&amp;#x27;s the only threat model under which e2ee makes sense. Expecting users in hundred-person group chats to manually verify each other individual user&amp;#x27;s keys is nonsensical. And even a single unverified key means that their homeserver operator could be listening in. I feel like Matrix should move more towards emphasizing how easy it is to self-host and maintain control of your own Matrix data, making e2ee is a non-issue.</text></item></parent_chain><comment><author>liotier</author><text>&amp;gt; Matrix should move more towards emphasizing how easy it is to self-host&lt;p&gt;They are already moving beyond that - towards P2P Matrix, with a network mixing traditional servers and individual nodes that collapse client and server: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;matrix.org&amp;#x2F;blog&amp;#x2F;2021&amp;#x2F;05&amp;#x2F;06&amp;#x2F;introducing-the-pinecone-overlay-network&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;matrix.org&amp;#x2F;blog&amp;#x2F;2021&amp;#x2F;05&amp;#x2F;06&amp;#x2F;introducing-the-pinecone-...&lt;/a&gt;</text></comment>