I’m not sure if it is entirely accurate to compare them in this way, as “Matrix” refers to simply the protocol, whereas “Signal” could refer to the applications, server, and protocol. That being said, is there any fundamental difference in how the Matrix ecosystem of federated servers, and independently developed applications compares to that of Signal that would make it less secure, overall, to use?
The most obvious security vulnerability that I can think of is that the person you are communicating with (or, conceivably, oneself, as well) is using an insecure/compromised application that may be leaking information. I would assume that the underlying encryption of the data is rather trustworthy, and the added censorship resistance of federating the servers is a big plus. However, I do wonder if there are any issues with extra metadata generation, or usage tracking that could be seen as an opsec vulnerability for an individual. Signal, somewhat famously, when subpoenaed to hand over data, can only hand over the date that the account was created, and the last time it was used. What would happen if the authorities go after a Matrix user? What information about that user would they be able to gather?
Matrix is less secure than Signal. While Signal and Matrix use the same encryption, Matrix doesn’t encrypt everything. This includes: message sender, message timestamps, reactions, members, read receipts, etc. All of this data can be accessed by the homeserver admin. On Matrix, you should assume that only the message content itself (text and attachments) is encrypted. Your account data is also not protected, you have to trust your homeserver admin. Signal is designed not to trust the server. It’s important to consider your threat model. Matrix doesn’t require a phone number, which makes it better for anonymity, but Signal has better security.
This is a good explanation of Matrix’s metadata leaks: https://web.archive.org/web/20210618055112/http://serpentsec.1337.cx/matrix
Do you just mean that your messages, for example, are stored on the server, and can thus be deleted by the server admin? Would you mind elaborating?
I think account data means stuff like email/phone if you’ve added those, IP addresses of logins, and that kind of thing.