The most important section of this post is here (I turn these things into a list):

Over the past six months, we’ve invested in improved tooling for the frontline team who review user reports.

1. We’ve sponsored the addition of account suspension to the Matrix Specification, and added a mass redaction API endpoint for the most popular Matrix server implementation, Synapse, so that both the Matrix.org server and other server instances in the ecosystem can benefit. Suspension gives us reversible account enforcement, which means we can develop more automated systems for faster takedown ahead of investigation. This should reduce the time that illegal material is accessible, while enhancing the rights and protections of our users.
2. We’ve also recently added authenticated media, stopping abuse of Matrix as a content distribution network. We worked with the IWF on this project, following reports of abuse of Matrix servers as a content delivery mechanism for ICAP sites.

In terms of privacy alone, neither of these points appear to benefit users. #1 benefits law enforcement and room moderators, and #2 benefits server owners, but not really from a privacy perspective.

Could the suspension API be maliciously used to lock down users’ accounts further? Based on this post alone, I can’t tell, but Matrix has a sketchy relationship with consent when it comes to having data deleted. (Constantly referring to their chat app as “like email” is also a bit misleading, the same way that referring to Bitcoin as “crypto-currency” is misleading.)

Matrix itself is a protocol (like email), defined as an open standard

Please, for the love of every person on the planet, replace email with matrix. It’s about time we got rid of that damn protocol and matrix seems like the best candidate for it.

It would be great if websites started adding a “sign up with your matrix ID” option and send confirmation messages over it. In fact, what’s holding them back? Matrix has automation, doesn’t it? And websites don’t need to host their own matrix server. They can have a bot client run in the background. Besides integration with popular web frameworks, that’s all that’s missing, isn’t it?

Anti Commercial-AI license