We report several practically-exploitable cryptographic vulnerabilities in the end-to-end encryption in Matrix and describe proof-of-concept attacks exploiting these vulnerabilities. When relying on implementation specific behaviour, these attacks target the Matrix standard as implemented by the matrix-react-sdk and matrix-js-sdk libraries. These libraries provide the basis for the flagship Element client. The vulnerabilities we exploit differ in their nature (insecure by design, protocol confusion, lack of domain separation, implementation bugs) and are distributed broadly across the different subprotocols and libraries that make up the cryptographic core of Matrix.

Status: Whilst the language of the paper and this website is in present tense, many of the vulnerabilities disclosed have been fixed. See our updated paper (or Matrix’ website) for more details. Our updated paper includes details of the mitigations for these attacks (alongside a few updates and corrections).

Populus-Viewer is a tool for decentralized social annotation, built on pdfjs, wavesurfer.js and the Matrix protocol. You can use it to read PDFs, listen to audio, or watch videos, and have rich discussions in the margins, with your friends, classmates, or scholarly collaborators.

Each uploaded file is attached to a matrix space, and each annotation to the file becomes a room within that space. Populus-Viewer has been tested with synapse and dendrite, but should be compatible with any spec-compliant matrix server.

Chupacabra enables users to archive and discuss web content free of surveilance and commercial influence. It can be used for personal research, micro-blogging, or discussing dank memes. Chupa posts are standalone archives of web content (a single HTML file with images embedded and scripts removed) and a corresponding Matrix message pointing to the mxc:// URI where the archive can be fetched. Posts can be discussed in real-time in the channel that they were shared. Behind the scenes, all post discussion is composed of replies to the post's Matrix message.

A multi-account Matrix client that allows you to authorize webapps to access parts of your account, designed with collaboration in mind.

A web-based admin control panel for a Matrix server. Lots of webshit involved.

• git clone https://github.com/Awesome-Technologies/synapse-admin
• cd synapse-admin/
• yarn install
• yarn build

Then tar up build/, upload it to your server, unpack it, and give it a try.

How to configure the Synapse implementation of Matrix to run in multi-worker mode for efficiency.

Archived in multiple locations.

This is a really simple matrix chat client. Just for simple use but also to mess around with the Matrix protocol. You can drop into the python interpeter in the middle of a chat and poke around with the Matrix Python SDK. Uses ncurses.

A minimal Matrix chat client, focused on performance, offline functionality, and broad browser support. Tries to be as desktop friendly as it is mobile friendly. UI components are reusable and composable. Can be added to an existing site. Stores everything locally. Right now it's a PoC.

PushBits is a relay server for push notifications. It enables your services to send notifications via a simple web API, and delivers them to you through various messaging services. For now, only the Matrix protocol is supported, but support for different services like Telegram could be added in the future. I am myself experimenting with Matrix currently because I like the idea of a federated, synchronized but still end-to-end encrypted protocol.

The idea for this software and most parts of the initial source are heavily inspired by Gotify.

Written in Golang.

A curated list of awesome stuff around the Matrix protocol, network, and ecosystem.

Simple but convenient CLI-based Matrix client app for sending and receiving messages. Fire and forget any kind of message that the Matrix protocol supports.

A Python module for accessing a Matrix server that is built using the no-I/O methodology - it conceals all of the input and output so development is focused on assembling what is sent and using what is received. Asynchronous in nature. In Pypi. Also end-to-end encryption capable. I don't know how flexible this library is so more investigation is required.

A CLI tool for interacting with the Matrix chat network. Can probably be used as a client, but it's actually designed to build other tools on top. Only uses the matrix-python-sdk module.

A collection of shell scripts for communicating with a Matrix instance. Requires a POSIX compatible shell and a copy of jq.

A Matrix server written in C++. Uses Boost, RocksDB, and Sodium for its back end. Currently implements all of the Matrix spec; implementing IRC is next.

Dendrite will be a Matrix server written in Go. Requires Kafka (if run as a cluster of microservices) or something called Naffka (an embedded in-process workalike) if run monolithically. Requires Postgres as its back end.

A moderation tool for Matrix. Set ACLs, ban and unban users, dry-run mode, antispam. Written in Javascript but nobody's perfect.

psql and shell scripts for maintaining a Matrix Synapse chat server. Currently looking for maintainers.

A directory of channels in the Matrix network, sorted by number of users in descending order. If you're looking for places to hang out, this would be a good place to start.