element-hq / element-hq/element-x-android
Element X does not warn or indicate when an unverified device logs in to my account
- Dominant language
- Kotlin
- Stars
- 2.4k
- Forks
- 624
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 149
Description
### Steps to reproduce
1. Log in to a account with Element X, and make sure encryption is set up and working.
2. Log in to that account with a client other than Element X, thereby creating a new device ID with new device keys. Do not verify this new device.
3. Open the original Element X session.
### Outcome
#### What did you expect?
Some kind of warning about the new unverified device that logged in to my account, or at least a notice, and a perhaps a reminder to verify it.
#### What happened instead?
There was no indication whatsoever that a new, unsigned device had logged in to my account. No warning. No prompt. No "was this you?" message. Nothing.
Even the Manage Devices web view lacks any indicator that the device is unverified. It looks just like the verified devices and those that have no device keys (do not participate in encryption).
This is problematic, especially if Element X is the only client I regularly use, because:
- I am left with no idea that a new device is now on my account, potentially monitoring my activity.
- I am not warned that my login password might have been compromised.
- I have no way of discovering which of my other devices still need verification.
- I have no information about how my account will appear to my contacts. I won't know until they complain to me, at which point I have already inconvenienced them. Or if they don't complain, I will be persistently inconveniencing them without knowing it. This also complicates things when I'm trying to guide someone through setting up Matrix for themselves, since I won't be able to tell them what they should expect to see when communicating with me.
### Your phone model
_No response_
### Operating system version
Android 14
### Application version and app store
Element X 25.11.0 f-droid
### Homeserver
matrix.org
### Will you send logs?
No
### Are you willing to provide a PR?
No
Contributor guide
Assessment
This issue has not been assessed yet.