element-hq / element-hq/element-web

TOFU e2ee identity reset warnings are unactionable

Open
#31,893 1 comment 1 reaction 0 assignees View on GitHub
A-E2EE A-E2EE-Cross-Signing O-Frequent S-Minor T-Defect Team: Crypto
Dominant language
TypeScript
Stars
13.5k
Forks
2.8k
PR merge metrics
PR metrics pending

Description

### Steps to reproduce

1. In an E2EE room, a user resets their E2EE identity (having forgotten their recovery key and started over, or having got pwned)
2. Everyone in the room sees a "Bob reset their encryption" banner
3. It's completely unclear what to do about this, and so most users promptly develop a blindspot to the banner and dismiss it.

### Outcome

#### What did you expect?

* [ ] At least show the mxid of the user who's reset - atm we don't show a mxid even if the displayname is ambiguous, making it very unclear who's identity has actually been reset.
* [ ] Provide a button to verify the new identity of the user to check whether they've been pwned or not.
* [ ] Provide a link to the memberinfo of the user so you can interact with them further from there (e.g. apply admin actions if needed, or verify them from the memberinfo)
* [ ] Alternatively, show the reset in the timeline rather than as a banner, like Signal and WhatsApp etc do.

#### What happened instead?

A big scary unactionable banner.

### Operating system

_No response_

### Application version

Element version: 1.12.8 Crypto version: Rust SDK 0.16.0 (95b5e83), Vodozemac 0.9.0

### How did you install the app?

_No response_

### Homeserver

_No response_

### Will you send logs?

Yes

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.