What exactly is the security of direct messages on lemmy? Does anyone actually use matrix?

I believe the intention of DMs is that they are supposed to be accessible only to the sending/receiving server admins and sending/receiving users -- but given the many ways that distributed systems which are not built specifically for secure comms can go wrong, you should simply assume anything you transmit through Lemmy is or will eventually be public, period.

If you are concerned that some information you transmit through Lemmy may be exposed the correct security stance is simply: DO NOT SEND IT.

Your DMs are not private on most Fediverse platforms. The ActivityPub protocol doesn't provide encryption or filtering on non-local content, and treats DMs very much like it treats comments or posts.

For instance, I equipped a Wordpress install with the ActivityPub plugin and connected it to a small Mastodon instance. I found that it could read every non-local DM coming from that instance.

Essentially, if you're DMing within an instance, it might be somewhat secure, depending on how the instance is setup. If you're DMing between instances, there is no security - assume anyone who can read the ActivityPub feed can read your messages.

I don't think private messages on Lemmy are E2E encrypted. I use matrix and I like it, but I don't have people to talk to so I made some bots.

The sending and receiving servers both have the message in plain text, so you can view them directly in the db.

According to what's said on Fedecan:

If a user from instance A sends a private message to a user from instance B, only the admins of instances A and B will be able to see the message. This is required to deal with spam and abuse.

I use Matrix, switched my personal chats over there once Discord got too sketch

I have a Matrix acc and joined several rooms of FOSS, but sadly it looks like most of them are still less active than their Telegram/Discord counterpart.

I dont know how tech saavy you are so apologies if this is an oversimplification but:

Matrix is a protocol. Think of it like a language. There are different matrix backends (synapse, continuwuity, etc) that run the server, which speaks the matrix protocol. Anyone can make a server and host it. They can open it up to federate, which lets other matrix servers talk to that server.

To join matrix you pick a server (matrix.org has one but there are many more. Some fediverse servers like bark.lgbt and blajah.zone have their own matrix servers under the same name). You sign up for that server same way you did for lemmy.

Then you pick a client. Element, cinny, sable, fluffychat are a few. These all "speak" the matrix protocol, the way something like the voyager app speaks activitypub, the protocol for lemmy. They all have slightly different features so use the one that has the features you like.

I love matrix. I self host my own but started on matrix.org. ive migrated my D&D group and friend group from discord to matrix.

if the server you join supports it, you can also bridge discord, telegram, and other chats to matrix. I still talk to some people on fisvord through a bridge.

I feel like its always been the case that messages in a forum are usually little things reltated to forum stuff that otherwise don't make sense or can't be done in a post. Not as a main source of messaging.

I use matrix.

I run an instance for myself an immediate family. I also federate with other instances to participate in some dev groups.

The most active matrix space I'm in, is the one hosted by ani.social. Daily activity on anime-related topics, and also fediverse, lemmy and software.

If you want to try it, the main "matrix.org" instance is far from easy to recommend though. Finding good public matrix instances is a challenge. As such the best way is probably to either host one yourself or know someone who does.

They are out there, though. I've seen people be happy with pikaviestin.fi, but that's only for finnish people. Mozilla also has an instance, though I've no experience on it.

A DM is only visible to the sending and receiving server. It is like an email. The server admin on both sides can read them in the database. They are encrypted during the transport with tls (https). The database is usually not encrypted at rest.

You can PGP encrypt them. That should make them secure.

Matrix is fantastic but choose a client and server carefully.

Yup, Inuse matrix, but it has a strong metaphor to email that you have to chose your provider. And the problem is that the official instance is under heavy load but at the same time, you don’t want to setup your acc with some noname homelabber pepe. I woud research second or third biggest instance and go there.

I use matrix. The soulslike comm has a server on it.

I ise matrix. It's pretty alright. Better than IRC

I use matrix.

I use Matrix for a lot of my chatting to friends. It works fine. Bit janky, but I don't mind.

The disclaimer you're seeing just means that DMs are not e2ee, so the server admins of the sending/receiving servers can read the message. You could use DMs to exchange details for chatting on an e2ee platform if this is a concern.

Matrix is spyware