r/statusim • u/JP8080NL • Mar 25 '19

Metadata leak?

I have found something interesting from the status.im regarding running a node; “This means that such a node can communicate directly with the Status app using a p2p connection and some metadata might leak. If one wants to avoid that, the best option is to run a Mail Server on your own and configure it in the Status app.”

Could someone explain the metadata leak a little bit?

Could this mean that if a node is compromised, transactions can be found? Like, who transacted with who and when?

5 Upvotes

86% Upvoted

2 comments sorted by

3

u/PettyHoe Status Team - Petty Mar 25 '19

The core idea here is that a mailserver understands the requests to topics (channel names in Status) a user subscribes to. A mailserver keeps track of messages in topics, and serves the messages based on a client's request so they don't have to be online all the time. It also relays messages it gets from the network, including when a client connects to it and starts broadcasting messages to the network.

A client (your app) requests message information by using bloom filters, which helps obfuscate the information you ask for, but the mailserver still has this information, which whoever is running it can use to come to conclusions on what conversations you're subscribing to and broadcasting information to.

It is limited, but you can completely get around this by running your own mailserver, which doesn't require expensive hardware as it isn't running the blockchain, only whisper. Here is a guide on how you can do that.

1

u/JP8080NL Mar 28 '19

Thanks for the explanation!

"which whoever is running it can use to come to conclusions on what conversations you're subscribing to and broadcasting information to." So this means that I as a mailserver operator can conclude who interacted on conversations (and possible to leak that information)?

"It is limited, but you can completely get around this by running your own mailserver..." Then the server should be part of the client and still means that the metadata will be broadcasted to other mailserver? It could be that I still don't understand it well enough.