I’m not sure if it is entirely accurate to compare them in this way, as “Matrix” refers to simply the protocol, whereas “Signal” could refer to the applications, server, and protocol. That being said, is there any fundamental difference in how the Matrix ecosystem of federated servers, and independently developed applications compares to that of Signal that would make it less secure, overall, to use?
The most obvious security vulnerability that I can think of is that the person you are communicating with (or, conceivably, oneself, as well) is using an insecure/compromised application that may be leaking information. I would assume that the underlying encryption of the data is rather trustworthy, and the added censorship resistance of federating the servers is a big plus. However, I do wonder if there are any issues with extra metadata generation, or usage tracking that could be seen as an opsec vulnerability for an individual. Signal, somewhat famously, when subpoenaed to hand over data, can only hand over the date that the account was created, and the last time it was used. What would happen if the authorities go after a Matrix user? What information about that user would they be able to gather?
It’s wrong to say matrix is only the protocol.
Matrix.org is the server that element defaults to and the vast majority of people use.
It is true that element hasn’t had a security audit, but the matrix.org servers have.
The protocol is separate from the server.
Matrix is only the protocol. Synapse is the name of the server software. “matrix.org” is just the URL of the main homeserver.
From Matrix’s About section:
Here, you can find Synapse.
This is a poor take and ignores the proper level of abstraction when discussing the situation.
Would you mind elaborating?
In context, disambiguating “matrix” the protocol, “matrix.org” the server and “element” the application obviously implies that “matrix.org” is not being referred to as the domain name.
“Matrix.org” in this case should be abstracted to mean the service as a whole providing the matrix.org website, matrix protocol endpoints, hosting solutions, business and other accoutrements.
The original question was in relation to signal vs matrix. “Signal” in this context refers to more than just the dns entry, business, protocol, frontend application or other elements. It should be obvious that referring to “Signal” implies all of these elements. Which is where my reply comes into effect.
You made the mistake of mistaking the organization (and all related services) of “element” and “matrix.org” and the matrix protocol. These are not the same thing. In the context of using the name of the thing to refer to the organization, servers and other errata; “Element” refers to a single independent organization and application that provides a single implementation of a client side portion of the matrix protocol. “Matrix.org” is a separate, independent organization that is providing a server implementation of the matrix protocol.
Your guess that “matrix” and “element” are interchangeable in the original article is incorrect. “Matrix.org” is a separate organization from “element”.
From this point of view, coming back with the statement “matrix.org is a domain name” is frankly insulting.