I’m not sure if it is entirely accurate to compare them in this way, as “Matrix” refers to simply the protocol, whereas “Signal” could refer to the applications, server, and protocol. That being said, is there any fundamental difference in how the Matrix ecosystem of federated servers, and independently developed applications compares to that of Signal that would make it less secure, overall, to use?

The most obvious security vulnerability that I can think of is that the person you are communicating with (or, conceivably, oneself, as well) is using an insecure/compromised application that may be leaking information. I would assume that the underlying encryption of the data is rather trustworthy, and the added censorship resistance of federating the servers is a big plus. However, I do wonder if there are any issues with extra metadata generation, or usage tracking that could be seen as an opsec vulnerability for an individual. Signal, somewhat famously, when subpoenaed to hand over data, can only hand over the date that the account was created, and the last time it was used. What would happen if the authorities go after a Matrix user? What information about that user would they be able to gather?

    • itchy_lizard@feddit.it
      link
      fedilink
      arrow-up
      8
      ·
      edit-2
      1 year ago

      Not if they’re outside the country’s jurisdiction. The point is that a company that has a business entity in the UK is required to follow UK laws. This is why signal is shutting down in the UK.

      A disorganisation run by volunteers in Japan can ignore the UK’s silly backdoor encryption laws; the UK has no legal authority over their servers.

      • fkn@lemmy.world
        link
        fedilink
        arrow-up
        5
        ·
        1 year ago

        And the Japanese government can force a backdoor into a server hosted in Japan. I don’t know what your point is or how it differs from what I said.

        Governments can absolutely force backdoors into individual servers. The point you are making about the UK is true for any matrix servers hosted in or by a UK entity. It’s not isolated to Signal. It’s debatable if matrix clients will be legal to distribute in the UK after their law goes into effect.

        • itchy_lizard@feddit.it
          link
          fedilink
          arrow-up
          1
          ·
          1 year ago

          So the community then moves the servet to Iceland.

          The point is that they can’t shutdown a community-run disorganization’s sever because it can just move. Companies that profit from a region are beholdent to that region’s laws.

          • fkn@lemmy.world
            link
            fedilink
            arrow-up
            2
            ·
            1 year ago

            I don’t know what you are arguing. You are talking about things I haven’t said or claimed… And you refuse to address the points I do bring up.

            What’s the point in talking to you if you arent going to participate?

            • itchy_lizard@feddit.it
              link
              fedilink
              arrow-up
              3
              ·
              1 year ago

              I’m arguing that a disorganisation isn’t beholdent to the laws of a few silly countries, unlike a corporation

              And I’ve addressed all your points.

              • fkn@lemmy.world
                link
                fedilink
                arrow-up
                1
                ·
                1 year ago

                But that doesn’t have anything to do with what I said?

                You haven’t addressed any of them? How does the fact that servers can be spun up in different countries affect those countries ability to inject backdoors into servers hosted in their country? When did I ever say block or remove communities? How does restricted legal access to third party clients like element confound the situation?

                It’s like you have some strawman argument setup and you are shouting at the void…

                Literally nothing you have posted on this thread is relevant to what I have posted.

                • itchy_lizard@feddit.it
                  link
                  fedilink
                  arrow-up
                  1
                  ·
                  1 year ago

                  You’re the one that’s not offering an argument to the solution.

                  Backdoors aren’t an issue because the software is end-to-end encrypted. And if a State sends a letter to the service’s operator asking them to install a backdoor, they just migrate the server to another State.

                  Disorganisations not tied to a geography are not beholdent to some silly countries laws in ways that corporate entities are.