[-] verifytheposter@leminal.space -3 points 1 day ago

Don't they always?

-34
-7
-6
[-] verifytheposter@leminal.space 1 points 2 days ago

Is there solid proof that it is used globally? Have technology experts conducted any research on it, or is verification simply impossible because they cannot inspect the code?

[-] verifytheposter@leminal.space 1 points 2 days ago

device_display_name is optional in the federation response. Current Synapse omits it by default, but it can still be sent when explicitly enabled. Older Synapse versions also exposed it through some federation paths.

I believe you are saying that my statement, “Federation copies all of that,” is incorrect. I agree. I should have said, “Federation copies most of that.”

However, the main concern remains: a homeserver can still collect the client type and version, the device being used, room names, topics, avatars, and other metadata. Much of this information is not necessary for delivering end-to-end encrypted messages, and its collection is concerning in itself.

67

every App Store search is logged letter-by-letter, with millisecond timestamps. Apple can compute your typing speed.

every search you type, timed to the millisecond, stored to your account

https://appleinsider.com/articles/26/06/17/apples-app-store-search-data-stores-every-single-keystroke

[-] verifytheposter@leminal.space 1 points 2 days ago

These aren’t mutually exclusive trade-offs: Matrix could support communities while minimizing or encrypting metadata by default. There should be a protocol that doesn’t require device details and profile data to be exposed just to participate.

[-] verifytheposter@leminal.space 3 points 2 days ago

Matrix can expose your device name and device details to other homeservers through federation. Profile information such as your avatar and bio can also be queried remotely. A client version is not a dedicated federation field, but it can leak through the device name. Signal at least has Sealed Sender, which hides the sender's identity from its own service in supported cases.

This is about metadata, not centralisation, self-hosting, or phone-number registration. Those are separate issues, not trade-offs.

[-] verifytheposter@leminal.space 1 points 2 days ago

It's already a problem that it sends the client's version, device details, avatar, and bio at all. Those device details are transmitted during federation along with everything else.

https://spec.matrix.org/latest/server-server-api

[-] verifytheposter@leminal.space 1 points 2 days ago

signal done it pretty well

[-] verifytheposter@leminal.space 1 points 2 days ago

Signal is free from this disaster, and client version and device details are only visible to the main server — not to mention the avatar, name, and many more items listed above being in plain text.

27

Matrix Metadata Problem: the server sees everything except your messages

People pick Matrix because of end-to-end encryption. But E2EE only protects message content — everything around it is plaintext.

The server sees:

  • Your ID, IP, client type and version, device you use
  • Your presence, typing status, read receipts
  • Which rooms you join and when you join/leave
  • Who else is in those rooms → your entire social graph
  • Room names, topics, avatars (all plaintext state)
  • For every message: who sent it, which room, a millisecond timestamp, type, size

And federation copies all of that to every other server whose users are in the room. Your "social footprint" isn't one copy — it's as many as there are servers.

12
submitted 3 days ago* (last edited 2 days ago) by verifytheposter@leminal.space to c/matrix@lemmy.ml

Matrix Metadata Problem: the server sees everything except your messages

People pick Matrix because of end-to-end encryption. But E2EE only protects message content — everything around it is plaintext.

The server sees:

  • Your ID, IP, client type and version, device you use
  • Your presence, typing status, read receipts
  • Which rooms you join and when you join/leave
  • Who else is in those rooms → your entire social graph
  • Room names, topics, avatars (all plaintext state)
  • For every message: who sent it, which room, a millisecond timestamp, type, size

And federation copies most of that to every other server whose users are in the room. Your "social footprint" isn't one copy — it's as many as there are servers.

-1
submitted 3 days ago* (last edited 3 days ago) by verifytheposter@leminal.space to c/matrix@programming.dev

Matrix Metadata Problem: the server sees everything except your messages

People pick Matrix because of end-to-end encryption. But E2EE only protects message content — everything around it is plaintext.

The server sees:

  • Your ID, IP, client type and version, device you use
  • Your presence, typing status, read receipts
  • Which rooms you join and when you join/leave
  • Who else is in those rooms → your entire social graph
  • Room names, topics, avatars (all plaintext state)
  • For every message: who sent it, which room, a millisecond timestamp, type, size

And federation copies all of that to every other server whose users are in the room. Your "social footprint" isn't one copy — it's as many as there are servers.

72

every App Store search is logged letter-by-letter, with millisecond timestamps. Apple can compute your typing speed.

every search you type, timed to the millisecond, stored to your account

https://appleinsider.com/articles/26/06/17/apples-app-store-search-data-stores-every-single-keystroke

19
submitted 3 days ago* (last edited 3 days ago) by verifytheposter@leminal.space to c/apple@lemmy.ml

every App Store search is logged letter-by-letter, with millisecond timestamps. Apple can compute your typing speed.

every search you type, timed to the millisecond, stored to your account

https://appleinsider.com/articles/26/06/17/apples-app-store-search-data-stores-every-single-keystroke

10

An IEEE S&P 2026 Distinguished Paper audited Apple's differential privacy. 5 of 9 mechanisms violate their own guarantees; ~87% of macOS data collection affected.

your typing stats + Safari domains leave your device daily, "anonymized" by a shield that's proven broken. No real protection.

https://arxiv.org/abs/2605.21378

[-] verifytheposter@leminal.space 1 points 1 month ago

Fair point. My mistake.

[-] verifytheposter@leminal.space 1 points 1 month ago

Fair point. My mistake.

5

Can RustDesk's telemetry be disabled? Collecting user device information, session duration, and other telemetry data seems unnecessary for a remote desktop application. Users should have the option to disable all telemetry and they should be disabled by default.

https://f-droid.org/packages/com.carriez.flutter_hbb/

6

cross-posted from: https://leminal.space/post/35929431

New to Nostr on Android. Do you use Amber, Citrine and Morganite for Nostr?

I just downloaded Amethyst to start using Nostr. While looking into setup guides and recommendations, I also came across Amber, Citrine, and Morganite.

Right now I’m wondering how people actually use these together in practice.

Do most of you just use Amethyst by itself and call it a day, or is it worth setting up the “full gem stack”?

Curious what setup you’re using and whether you think the extra apps are worth it.

#Nostr #Amethyst #Amber #Citrine #Morganite #NostrApps #NostrClient #AndroidApps #PrivacyApps #Decentralized #DecentralizedSocial #OpenSource #Fediverse #CryptoApps #SecureMessaging #NostrCommunity #TechTips #AppSetup #GemApps #MobileApps #DigitalPrivacy #SecureSocial #P2PApps #PersonalData #NostrNetwork #SecureNetwork #NostrGuide #NostrNewbie #MobilePrivacy #TechExploration #SelfHosted #TechCommunity #AppRecommendations #PrivacyTools #DigitalSecurity #MobileSocial #OpenSourceApps #NostrTips #NostrSetup #DataOwnership #PrivacyMatters #SecureCommunication #TechEnthusiast #PrivacyFirst #MobileTech #NostrLife #NostrAndroid #PrivacyConscious #SecureMessagingApps #TechAdvice #SocialNetworking #GemStack #NostrStack #TechCurious #DigitalFreedom #DecentralizedSocialNetwork

view more: next ›

verifytheposter

0 post score
0 comment score
joined 3 months ago