November 28, 2016
In the aftermath of the 2016 presidential elections in the United States, many people shared their concern about how the privacy of US citizens could be negatively impacted following Trump’s victory. Adding this to the already existing issues with online security, several users decided to look for more secure ways to interact and share information online.
Enter the Matrix
Regardless of the role Trump’s election might have in the privacy sector, the importance of comprehensive security can never be understated. With this in mind, Matrix, the open standard protocol for real time communication, is announcing the extension of its end-to-end encryption library across all platforms, including Web, iOS and Android. This will happen with a formal beta for its end-to-end encryption library, Olm.
In addition, Matrix.org is also revealing the results of the full review of Olm, which was conducted by NCC Group last September and funded by the Open Technology Fund. Matthew Hodgson, Matrix.org’s Technical cofounder, commented on the importance of this news:
“With Matrix.org and Olm, we have created a universal end-to-end encrypted communication fabric – we really consider this a key step in the evolution of the Internet. Now that Olm is complete and audited, we want it to be available to everyone out there without restriction – we have released it as permissively licensed open source for the benefit of the whole community. The internet now has all the tools it needs to securely defragment communication silos.”
What It Provides
For users, end-to-end encryption provides true privacy, assuring that no third-party can possible eavesdrop on their conversations. As a matter of fact, this type of encryption is so powerful that “spies” cannot even know the communication service that is being used to transmit those messages.
When using Matrix, all data is encrypted at every stage, meaning that both data in storage and in transit is secured. With this, users have no need to worry about any potentially unsafe servers because, even if data were to be stolen, its encryption assures that no one will be able to understand it. Such a system has important applications in businesses collaboration apps, as most current options are known to snoop on user data.
Matrix’s end-to-end encryption architecture, built with the Olm and Megolm cryptographic ratchets, is unique in several ways. Matrix is built for interoperability, being built to work with other communication protocols such as XMPP. Also, the entire implementation and formal specification is entirely open source, being available under the permissive Apache License.
The system also works per device, instead of per user. This means that users can stop decryption in a given device if, for example, they lost it or forgot it at a friend’s house. Last but not least, the use of Megolm allows users to select the amount of history they can decrypt on a new device.
Taking Security Seriously
The security assessment conducted by NCC Group is a very important milestone for Matrix, and the spotted issues (one high, one medium, and various low and informational) were either solved in libolm v2.0.0 or addressed in the associated Matrix client SDKs. Alex Balducci, Principal Security Consultant from NCC Group, had his saying on Matrix’s level of security:
“It was great to work with a team like Matrix, who take security seriously and have a passion for this line of work. While challenging, the engagement was a great experience and I am glad to have had the opportunity to play a role in it. The goal of open interoperable cryptography on the Internet is a worthy one, and we wish the project the best success. I also want to call out the Open Technology Fund for helping support this engagement and making the Internet a more secure place!”
With more and more startups and companies becoming vulnerable to cyber attacks and hackers, this level of security being made available to everyone is a step in the right direction. Safety online will soon become as comprehensive as safety in the real world.
Did you like this article?
Get more delivered to your inbox just like it!