223
How Matrix is becoming the communication standard for Public Sector (www.youtube.com)
submitted 2 days ago by to c/opensource@lemmy.ml
52 comments fedilink hide all child comments
 

Matrix was built to become the open communication of the web and serve everyone. But, as the Internet and email did, its network effect started with governments. Today, and as proven by the audience in the room, most European governments and several others are either using it or looking at implementing it for their communications. This talk will tell the story of how we got there and why.

you are viewing a single comment's thread
view the rest of the comments
[–] 9 points 22 hours ago (5 children)

Honestly the only real problem that's holding me back from using Matrix for everything is that it's really inconvenient (for non technical people) to set up an additional device, as you have to verify it.

I've had to walk too many people through this.

  • permalink
  • fedilink
  • source
  • hideshow 5 child comments
    •
  • [–] 1 point 25 minutes ago

    I've just telling my normie friends who join to disable end to end encryption. If they're on my homeserver it doesn't matter, as we're all communicating internally, and if their account is on m.org... Well... Just mind what you say? No different than chatting on Discord or WhatsApp, IMO.

    People get annoyed about the setting up of devices, but that's literally tied to a new type of feature you probably don't need. And e2e shouldn't be by default for most people who can't even remember passwords - I still remember losing all my signal messages because I didn't backup my recovery key and my one phone with it installed decided to, helpfully, clear out my data :)

    Tl;DR being unintentionally forced to engage in e2ee is always going to be a bad experience. Our non-technical friends are coming from platforms without it, just forego it for the time being. (yes, I don't care if WhatsApp or whatever claim to have it, if they own your keys it ain't e2ee)

  • permalink
  • fedilink
  • source
  • parent
  • [–] 5 points 17 hours ago (1 child)

    Interesting, how does that verification process work? I've never really used matrix so I'm curious.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 7 points 16 hours ago* (last edited 15 hours ago)

    (Sorry about the length, I'm rather passionate about this. The second half can be ignored)

    Essentially, the key to decrypt your old messages is tied to your session. On your (presumably) first session, you can get a recovery key, which is a long hexadecimal string, and a recovery passphrase which you can decide yourself.

    If you start a new session (i.e., you log in on another client), for your opd messages to be visible on the new one and your new messages on the ols one, you need to "verify" the new session. There are three ways you can do this.

    1. Enter your recovery key
    2. Enter your recovery passphrase
    3. Interactively verify with your old session, which pops up some emojis on your old client and your new client and now you need to say they match on both.

    Alternatively, if you forgot your key and your passphrase and logged out on all the other sessions, you can reset your recovery key, creating a new one and making your old messages unreadable.

    (The following are just my thoughts on this) The recovery key is a PITA because most non-technical people I know don't use password managers. Even if they did, though, it's not like any password manager (afaik) offers to save your recovery key. You need to manually put it in there, separate from your account password, and manually enter it when you're connecting a new client.

    The recovery passphrase somewhat mitigates this, as they could simply use their favourite "use it everywhere" password, but I don't think I need to point out the problems with that.

    The emoji thing is cute and works quite well, but somehow people still get confused and justifiably vaguely irritated that they have to do it at all.

    You just can't expect normal people to understand that these are important security measures, they just want to log in and be done.

    That said, most people log in once on their phone, very maybe twice to also have it on their laptop and then never have to think about it again. That, however, is a problem in and of itself, because at some point they'll get a new phone, chuck the old one, try to log in and realize they have no idea what their key is.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 4 points 17 hours ago (1 child)

    Same, I have a discord community and it is been impossible to get people to move to Matrix or anything else. The one person who really tried ended up messing up their encryption keys and gave up.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •