Element (Matrix) launches Chatterbox, end-to-end encrypted embedded chat (opens in new tab)

I'm running it on my own server and performance is quite acceptable. Picking the right client is very important, though; Element isn't always the fastest, and I find Cinny's UX to be much better for general chat, which is clearly very much… inspired by Discord. On the other hand, Element is ahead in terms of features and protocol support (like the (live) location sharing feature), but Fluffychat has the superior mobile app in terms of general look and feel IMO. On the desktop, Nheko is incredibly fast, being written in a native language and being optimized for performance and all, but I don't use it because I just can't get used to the design.

When joining huge chat rooms like some of those on the matrix.org homeserver, it can take a bit for the clients to sync up and get going. Performance is getting improved all the time, especially in terms of quickly joining a room. Latency also doesn't help, the protocol requires loads of round trips for the JSON payloads to go back and forth, so if you're not near your homeserver you're going to see some annoying problems.

I recommend giving the platform another quick try using https://app.cinny.in/ which to me feels very Discord-like in terms of snappiness.

this is like saying “i tried the web, and it’s extremely slow”. what server were you using? and which client on which platform?

I found the same, as soon as I join any larger rooms it starts to struggle.

The clients feel sluggish as well, just in terms of moving around the UI.

This is part of a hosted package. In theory, this means that the folks over at Element.io can't see the chats between you and your customers/business partners because of the E2EE. That does depend on them not hosting the software, of course, because E2EE becomes useless if the software used to encrypt data can be changed at a whim.

With the private keys on the recipient end and the browser end, it does make it easier to follow certain data privacy regulations. Whether the rather leaky Matrix protocol is considered foolproof is still an unanswered question, though; the average encrypted chat session sends a LOT of unique identifiers that shouldn't cause any trouble, but I haven't seen a recent audit of the protocol.

> What is the benefit of end to end encryption in this scenario?

Let's say I'm talking to my bank. Is there really any information that you want open? They're going to ask you security questions to confirm your identity. You're likely talking about specific sums of money.

Let's say you're talking to your doctor. Is there really any information that you want open? Are you violating HIPPA and privacy laws just by talking? Your health is of no concern to anyone but you and your health provider. Full stop.

I mean, they use these two examples in the post. The use case is pretty clear to me here. The risk isn't your service provider spying on you, it is anyone that you aren't intending to talk to. A hacker (who may be interested in your bank or health care). A state actor. Abusive ex. Data companies that extract every bit of information they can. Or politicians who want to track your period. Maybe this isn't useful when I'm submitting tickets to wandb, but I can see this being very helpful when I'm talking to my bank.

Hmm, I'd say it depends.

Imagine you're contacting a doctor and are communicating about sensitive stuff. I'd still expect this to been treated relatively confidential, i.e. not spreading it within the company, or potentially leaking it.

Plus, the matrix server of the person on the other side might not be in your hands, e.g. hosted by Element

E2EE can prevent the leaking of private conversations to thirdparty middleware/cloud companies. This would allow orgs to continue using those thirdparty services to handle their traffic like usual, but would also guard against middleware disasters like cloudflair's leaking of https traffic.

Thanks to the prevalence of early HTTPS termination (usually at the edge of some big cloud company), that green pad lock at the top of your browser means little when true privacy is needed.

In addition to points from others: no middleman can tamper with the information being sent (e.g: see how Russia changes content of pages served via http to display war propaganda or ads).

You can host chatterbox yourself too - it’s apache licensed FOSS (https://github.com/vector-im/chatterbox).

Hi there.

I wrote [1] (Thanks for the reference) , and i skipped encryption for the sake of simplicity.

I'm enabling encryption as we speak.

If you host the server yourself, on a controlled setting (VPS), it should allow for a fairly secure way of communication if TLS is used. The communication channel would resemble this rough ASCII drawing:

[Browser] <---TLS---> [livematrix] <---e2ee---> [Matrix homeserver]

In the end you always have to trust the person hosting the service. Host things yourself.

I don't see this channel of communication as being truly secure, without audits where and how its deployed. Web apps are riddled with vulnerabilities, how much of the attack surface from a website would compromise the live chat embedded is a guess until it happens.

I should point out that my "solution" is intended for personal websites, people who enjoy Matrix a lot :) . Not for corporations at all.

The former doesn't have encryption, but good question

It’s using normal Matrix olm/megolm double ratchet encryption.

To track the identity of who you’re talking to we can do TOFU and/or normal out of band Matrix verification as per https://github.com/vector-im/hydrogen-web/issues/518 - but this isn’t yet exposed in Chatterbox. We’ll get it added, as without verification you obviously can’t spot a MITM.

This is my question, too.

From TFA:

>there’s no need for them to register or create an account just because it’s E2EE, and it still supports persistent messaging.

How does that work? Arathorn in a sibling comment says that there's out of band something, which I interpret to mean some verification process, but for the life of me I can't imagine what that process might be or how it might work without any sort of account... unless the client generates a unique a key per user session and coordinates the key exchange with a single host server behind the scenes to encrypt that session's data?

What am I missing?

Normal users will probably just check that the green padlock in their address bar.

I think this is targeted towards securing chat traffic from thrid-party hosting services accidentally leaking or passively spying on you. Think problems that arise from early HTTPS termination like the cloudflair's https leak.

Does it have export?

Signal's complete inability to any kind of history backup is a dealbreaker for me.

It’s $3/MAU for the users who are using a fullblown Matrix client like Element on the server. Meanwhile users who are coming in via the lightweight Chatterbox client are only $0.80/MAU. And users who come in via federation are free.

We’ll see how the pricing fares in practice.

How so?

This could be useful for smaller business that don't want to maintain their own servers. Element already provides hosting services for Matrix chat [1]. Businesses can use it, without worrying about messages being exposed to the hosting service.

[1]: https://element.io/matrix-services

You can use any matrix client to interact with the customers. New customers will appear as direct chats in your preferred client.