Malicious homeserver can trick Element/Schildichat into revealing links in E2EE Rooms

The Desktop and Web versions of the popular Matrix client Element, as well as its fork Schildichat, support link previews. These can also be activated inside of end-to-end encrypted chats.
The problem arises from its implementation: The setting is stored insecurely on the homeserver and URLs are sent to the homeserver for link preview generation.
This article is the a full disclosure on this issue.

true

Missing Salamanders: Matrix Media can be decrypted to multiple valid plaintexts using different keys

End to end encryption in chat protocols is a complex topics with lots of pitfalls.

One such pitfall is failing to verify that a ciphertext is meant to be decrypted with a specific key, or that a ciphertext is meant to decrypt to a specific plaintext, especially when an attacker can specify the key.

This post is about how Matrix does not perform authenticated encryption at all for media sent in end-to-end encrypted chats.

true

Pokémon Gen 1 Living Pokédex Journey Introduction

I have wanted to build a living Pokédex in the Pokémon games for quite a while and decided that this summer would be as good time as any to start catching them all. After noticing accidental save corruption (some Pokémon disappeared from the box) in the emulator I was using previously, I decided to restart Pokémon Yellow and write down my experiences down the line.

true