element-hq / element-hq/element-web
TOFU e2ee identity reset warnings are unactionable
- Dominant language
- TypeScript
- Stars
- 13.5k
- Forks
- 2.8k
- PR merge metrics
- PR metrics pending
Description
### Steps to reproduce
1. In an E2EE room, a user resets their E2EE identity (having forgotten their recovery key and started over, or having got pwned)
2. Everyone in the room sees a "Bob reset their encryption" banner
3. It's completely unclear what to do about this, and so most users promptly develop a blindspot to the banner and dismiss it.
### Outcome
#### What did you expect?
* [ ] At least show the mxid of the user who's reset - atm we don't show a mxid even if the displayname is ambiguous, making it very unclear who's identity has actually been reset.
* [ ] Provide a button to verify the new identity of the user to check whether they've been pwned or not.
* [ ] Provide a link to the memberinfo of the user so you can interact with them further from there (e.g. apply admin actions if needed, or verify them from the memberinfo)
* [ ] Alternatively, show the reset in the timeline rather than as a banner, like Signal and WhatsApp etc do.
#### What happened instead?
A big scary unactionable banner.
### Operating system
_No response_
### Application version
Element version: 1.12.8 Crypto version: Rust SDK 0.16.0 (95b5e83), Vodozemac 0.9.0
### How did you install the app?
_No response_
### Homeserver
_No response_
### Will you send logs?
Yes
Contributor guide
Assessment
This issue has not been assessed yet.