#libolm — Public Fediverse posts

@Forbearance
> An irate blue wolf told me that Matrix was afflicted with a Library of Olms and we shouldn't use it

This person is spreading FUD.

"The CVEs have since been edited post-submission to conflate libolm with the Olm protocol itself. A genuine protocol vulnerability would be much more serious so we are working with MITRE to clarify."

https://matrix.org/blog/2024/08/libolm-deprecation/

libolm has been formally deprecated in favour of a new Olm library.

#Matrix #Olm #LibOlm #vodozemac

@drwho @matthew

FYI: A ton of third party #Matrix clients use the deprecated #libolm library for end-to-end encryption which suffers from multiple vulnerabilities:
https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library/
libolm has now been deprecated: https://gitlab.matrix.org/matrix-org/olm/-/commit/6d4b5b07887821a95b144091c8497d09d377f985
These vulnerabilities appear to be known for quite a while now but are not a considered serious issues by authors of other Matrix clients.

There is a "new" #Rust based crypto library called #vodezemac that has been used by the official #Element clients for about 2 years.

#FluffyChat and #Nheko are working on their clients:
https://github.com/krille-chan/fluffychat/issues/1258
https://github.com/Nheko-Reborn/nheko/issues/1786#issue-2441024627
Keep in mind that these clients are personal projects maintained by their authors in their free time. Element has a dedicated team for security aspects.

Edit: This post has been edited to include some corrections

#Security #Messenger #Olm #FOSS #Privacy