We need a way to restrict the permissions specific matrix apps have to utilise your account. (SPEC-79)

Both Hugh NS and jercos on IRC have called out that if you are handing your matrix HS credentials to an increasingly large set of random matrix-enabled apps, you are trusting these apps with a lot of power. (See IRC convo with jercos below).

My suggestion is that we either need much better support for creating ephemeral IDs which somehow fwd to your official one, but only have the ability to access rooms & history that they are explicitly invited to... or we need a formal FB-permissions model which specifies ACLs for a given app when you hand over your matrix credentials.

Dec 8 21:37 (IRC jercos) wow, that what-is-the-matrix post sounds like a local security nightmare
Dec 8 21:37 send a private message to a friend? now every app on your phone knows about it. and then suddenly you get google ads for things you've PMed people about.
Dec 8 21:46 (IRC Arathorn) @​irc_Arathorn:matrix.org jercos: how would google get to see the msg to advertise it?
Dec 8 21:47 if you don't want ads, don't use spyware apps which upload your messages to google :)
Dec 8 21:47 or use end-to-end crypto
Dec 8 21:48 to contrast: "send an email to a friend? now every mail client on your phone knows about it."
Dec 8 21:48 except you don't get google ads because a) you don't use google for your server, you run it yourself or use someone who respects your privacy
Dec 8 21:49 b) you choose mail clients who don't randomly go and datamine your mail.
Dec 8 21:49 so i think it's a fairly major win for local security
Dec 8 21:49 (but then again i'm not exactly neutral :-)
Dec 8 21:50 (IRC jercos) @​irc_jercos:matrix.org Arathorn: I don't log into my email account from 20 different apps as a matter of policy
Dec 8 21:50 * (IRC jercos) shrugs
Dec 8 21:50 (IRC Arathorn) @​irc_Arathorn:matrix.org i wouldn't expect you would with matrix either
Dec 8 21:50 (IRC jercos) @​irc_jercos:matrix.org obviously an informed user would very carefully choose what apps to use
Dec 8 21:50 (IRC Arathorn) @​irc_Arathorn:matrix.org you'd just pick a few favourite apps
Dec 8 21:51 the one with the best video calling... the one with the sexy UX... the one with the bes tgroupchat
Dec 8 21:51 (IRC jercos) @​irc_jercos:matrix.org an uninformed user can e.g., "sign in with google" without giving an app access to their mailbox
Dec 8 21:51 (IRC Arathorn) @​irc_Arathorn:matrix.org so it's no different to me having mailbox, k9, native imap and roundcube or similar for my mail accounts
Dec 8 21:52 (IRC jercos) @​irc_jercos:matrix.org specifically using the example in the article, what stops the football app from reading your IMs?
Dec 8 21:52 maybe it's a well-behaved football app, but if it can read your IMs, that breaks the implied security model around apps
Dec 8 21:52 (IRC Arathorn) @​irc_Arathorn:matrix.org jercos: you have to explictly pick your server. and even uninformed users can pick not-google (just as today with email)
Dec 8 21:53 in that example, yes - your football app could read your IMs. it's a good point i guess
Dec 8 21:53 either we need to support multiple personas more easily
Dec 8 21:53 (the equivalent of throwaway mail accounts)
Dec 8 21:53 or everything ACLed off by default
Dec 8 21:54 or per-app ACLs
Dec 8 21:54 will have a think.
Dec 8 21:54 in retrospect it is a good point :)
Dec 8 21:54 (IRC jercos) @​irc_jercos:matrix.org :D plenty of room to add that security
Dec 8 21:55 and to boot, that specific example I would see being more useful as a matrix-powered service than a matrix app
Dec 8 21:55 like text message updates, subscribe and get them without installing anything
Dec 8 21:56 but the genericism that would allow it to be used as a carrier of data to an app could just as easily wind up with a dedicated account being made automatically for that app
Dec 8 22:39 (IRC Arathorn) @​irc_Arathorn:matrix.org yup. you could implement the security either through throwaway accounts or per-app ACLs or some other model
Dec 8 22:39 but agreed that we need it.

(Imported from https://matrix.org/jira/browse/SPEC-79)

(Reported by @ara4n)

No implementation files, tests, or entry points are named. Start by resolving whether the project should use ephemeral identities, per-app ACLs, or another permissions model, then define the protocol behavior and security boundaries; the work is done when one model is specified clearly enough for implementation.