Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Verifying your Matrix devices is becoming mandatory

element.io

Post reply on HN
Print view View original

11–20 of 251 posts

Re: Verifying your Matrix devices is becoming mandatory

#11

Post by ranger_danger »

olivia-banks wrote: post #2

What exactly does this entail? I'm willing to be charitable in assuming that their use of "verify" isn't the modern usage of "give us your ID!" but I'm not enmeshed enough in the ecosystem anymore to know.

My understanding is that there's two different types of verification.

Self-verification means that any new secondary devices you log into your account with will need to be verified by an existing login by way of an automatic popup that asks if you trust the device. It used to just be a Yes/No button but I think now they've added QR codes and/or emoji matching.

The other kind is verification between two different people, like when starting a direct message conversation, you might get the same emoji matching window to verify each other.

Re: Verifying your Matrix devices is becoming mandatory

#12

Post by ranger_danger »

bfkwlfkjf wrote: post #6

Is this the ritual of getting together with a person and checking that their fingerprint match what you see on the app? If this is that case what will happen is that people will start verifying everyone (because they might want to text to strangers that they can't bother verifying because the stakes are so low) and so verification will lose all meaning.

Isn't this how TLS itself already works? "trust on first use"?

Re: Verifying your Matrix devices is becoming mandatory

#13

Post by jerrythegerbil »

As someone whose devices randomly became unverified just a few months ago, signed out, and then tried to use my recovery keys: I was authenticated, but unverified.

When attempting to verify iOS, Desktop linux didn’t work. When attempting to verify Desktop Linux, Desktop Windows didn’t work. When verifying Android, iOS didn’t work. Every verified official client for every platform was verified, tried a different verification method than expected, and failed.

All of this to say, this isn’t the first time this has happened to myself and others. Forcing verification is otherwise known as unexpected “offboarding”. If some verification methods have problems, publish a blog about their deprecation instead.

I love element, but this can’t be done without prior work to address.

Re: Verifying your Matrix devices is becoming mandatory

#14

Post by treyd »

ranger_danger wrote: post #12
bfkwlfkjf wrote: post #6

Is this the ritual of getting together with a person and checking that their fingerprint match what you see on the app? If this is that case what will happen is that people will start verifying everyone (because they might want to text to strangers that they can't bother verifying because the stakes are so low) and so verification will lose all meaning.

Isn't this how TLS itself already works? "trust on first use"?

With PKI you're trusting a certificate chain up to a CA you already trust, by way of your OS or browser vendor.

A domain can layer on HSTS to that, which directs clients to additionally refuse to trust a new cert for a domain until the one you currently trust has expired.

Re: Verifying your Matrix devices is becoming mandatory

#15

Post by pavon »

ranger_danger wrote: post #12
bfkwlfkjf wrote: post #6

Is this the ritual of getting together with a person and checking that their fingerprint match what you see on the app? If this is that case what will happen is that people will start verifying everyone (because they might want to text to strangers that they can't bother verifying because the stakes are so low) and so verification will lose all meaning.

Isn't this how TLS itself already works? "trust on first use"?

Not in current practice. That is why you have to get a certificate from a trusted CA. If your CA isn't in the browser's cert database they will reject the connection even on the first time. If browsers allowed TOFU we would still be able to use self-issued certificates, without manually distributing certs to anyone that uses your service.

SSH is an example of TOFU.

Re: Verifying your Matrix devices is becoming mandatory

#16

Post by navigate8310 »

totetsu wrote: post #7
tripdout wrote: post #3

What is verification? What does it involve doing? A lot of information on why it's useful, but how is it implemented? I hope it's not something like the Play Integrity API, but with no information to go on, I can't say either way.

https://element.io/en/help#encryption-device-verification > After Alice logs in on a new device, she uses her cryptographic identity to demonstrate to Bob that the new device genuinely belongs to her, rather than being added by someone else with access to her account. She can do this either by entering her recovery key (which gives the new device immediate access to her cryptographic identity ), or by carrying out an…

So is this like the Signal PIN which is required when installing on a new device? If you forget, the cryptography changes and old contacts are warned that signatures are rotated, right?

Re: Verifying your Matrix devices is becoming mandatory

#18

Post by kevincox »

navigate8310 wrote: post #16
totetsu wrote: post #7

Earlier quoted context omitted.

https://element.io/en/help#encryption-device-verification > After Alice logs in on a new device, she uses her cryptographic identity to demonstrate to Bob that the new device genuinely belongs to her, rather than being added by someone else with access to her account. She can do this either by entering her recovery key (which gives the new device immediate access to her cryptographic identity ), or by carrying out an…

So is this like the Signal PIN which is required when installing on a new device? If you forget, the cryptography changes and old contacts are warned that signatures are rotated, right?

Yes, the purpose is the same but the UX is a bit different.

Re: Verifying your Matrix devices is becoming mandatory

#19

Post by kevincox »

hedora wrote: post #17

I don’t use Matrix, but if it’s E2EE, then how is it possible in the current design for an unverified device to even exist? It has the keys, or it doesn’t, right?

Matrix has E2EE support and many clients are pushing it as the default. But it also supports rooms that are only encrypted in transit.

Re: Verifying your Matrix devices is becoming mandatory

#20

Post by toastal »

I tried out an alpha client once & can’t get the stupid pop-up about unverified devices to go away now. Another client didn’t have the verification flow even set up—this will end up being yet another barrier to entry for new clients. With the clients (yes, multiple) crashing often, constantly syncing for ages, & feature sets not on parity + without graceful fallbacks, I do not like the Matrix client space (nor the server space, but that is a different topic).

There has never been a better time to (re)embrace XMPP as your decentralized chat option. The clients are less buggy, handle missing features gracefully, & best part is, not being built on an eventual consistency model, you don’t have the constant syncing issue with delayed messages. If you wanted you could make an XMPP client in a day since the base spec is small/simple—& features like device verification would be seen as mandatory in the base specification.

Post reply on HN