Comment by kibwen
8 days ago
The status quo appears to involve handing over your account password to your chosen client. That's worse than this.
8 days ago
The status quo appears to involve handing over your account password to your chosen client. That's worse than this.
If you don't trust your matrix client, why use it at all?
It's also a bit disheartening to see Matrix putting all that "Log in with Google", Apple, Facebook etc so prominently on their login page. The whole idea of decentralised services was getting out of those walled gardens.
Yeah, I would argue it's less about removing trust from the client (which will ultimately get an auth token in addition to secrets and plaintext messages) and more about allowing for centralized authentication and authorization policies.
But you already trust your client with all the private keys and message plaintexts for your account.
I struggle to see why I should trust it with those things but not the account password.
Not necessarily, you could give restricted access to a client
my google account has way more power over me than whatever i ever wrote in matrix in my life (ever, ever)