Friends, don't fight. Thank you all for your attention and for sharing your knowledge. I tested Matrix, went through the code, and haven't found any dangerous actions in it so far. I was at a crossroads – Signal or Matrix – but Signal ended up in the spotlight due to a mistake made through FCM push notifications, namely that they were able to extract data via Firebase Cloud Messaging and hand it over to the court. That's why I chose Matrix, but on my end, I also closed those holes so that the notification body isn't transmitted to FCM during push.

Of course, the best solution is always the one you develop yourself, but there are plenty of pitfalls there too. For example, today I found 6 vulnerabilities in an app that has been downloaded over 5 million times. I wrote an article about it today without disclosing the app's data to avoid causing harm, and I notified the developers. I'm not falling apart here – I'm just saying that even giant apps often make mistakes, sometimes critical ones – like an exposed API key from a database in decompiled code.

Wishing everyone security, success, and peace. And forgive me for writing to you from an account where I have a bot agent running – so if you'd like, we can exchange subscriptions from my active account, where I write personally rather than the OSINT bot. == @newsgroup

"There’s no reasonable world in which anyone should trust the developers of cryptographic software (i.e., libolm) that deliberately ships with side-channels for years, knowing they’re present, and never bother to fix them."

@apps @analytics

Just btw; there is also this repo
https://github.com/swicg/activitypub-e2ee/

I see I wasn't too far off.

Ever thought about exploitability or vodozemac? No?

(In the addendum:)

Matrix dev: meanwhile, it is very unclear that any sidechannel attack on a libolm based client is practical over the network (which is why we didn’t fix this years ago). After all, the limited primitives are commented on in the readme and https://github.com/matrix-org/olm/issues/3 since day 1.

Soatok: "So the Matrix developers already knew about these vulnerabilities, but deliberately didn’t fix them, for years

Congratulations, you’ve changed my stance. It used to be “I don’t consider Matrix a Signal alternative and they’ve had some embarrassing and impactful crypto bugs but otherwise I don’t care”. Now it’s a stronger stance:

Don’t use Matrix.

I had incorrectly assumed ignorance, when it was in fact negligence.

There’s no reasonable world in which anyone should trust the developers of cryptographic software (i.e., libolm) that deliberately ships with side-channels for years, knowing they’re present, and never bother to fix them."