Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Verifying your Matrix devices is becoming mandatory

element.io

Post reply on HN
Print view View original

21–30 of 251 posts

Re: Verifying your Matrix devices is becoming mandatory

#21

Post by Lerc »

kevincox wrote: post #18
navigate8310 wrote: post #16

Earlier quoted context omitted.

So is this like the Signal PIN which is required when installing on a new device? If you forget, the cryptography changes and old contacts are warned that signatures are rotated, right?

Yes, the purpose is the same but the UX is a bit different.

Quite. I have yet to manage a verification between clients.

I have had all variations of clients ignoring requests, reporting requests only for the requesting client to ignore the response. Both ends quitting declaring that the other end cancelled, asking for the other end to input a code while the other end shows no interface for doing so.

It marked the end of me using Matrix as a platform. I'd go back to the old IRC channels if there were anyone still there.

Re: Verifying your Matrix devices is becoming mandatory

#23

Post by iqihs »

I think Matrix as a protocol has been pretty ineffective, as their top priority seems to be keeping data permanent and duplicated. Both performance and privacy are at the bottom of their priority list. The one good thing I can say about it is that encryption of message contents is enabled by default in conversations and available in groups, but that's about it - nothing else is, or can be, encrypted. In other words, every participating server knows who is talking to who, and how much, and when, and in what rooms, and what those rooms' names are, and what those rooms' descriptions are, and who moderates them, etc.

Meanwhile, an app like Signal can do none of that, and that's by design.

If you're looking for a privacy oriented messaging system, you'd best look elsewhere.

I'm new to Matrix and found this comment on reddit. How much of it is accurate and does it actually contribute to whether or not the future of the protocol is promising?

Re: Verifying your Matrix devices is becoming mandatory

#24

Post by unbolted3032 »

I decommissioned my server 3 months ago and migrated my community back to IRC. I still had the IRC Podman containers kicking around, so that was easy.

I dealt with ~monthly issues around my devices not being correctly verified, messages not correctly decrypting, and various other rough UX edges. There seemed to be a lot of velocity in the beginning but the last couple of years have addressed approximately nothing in terms of the UX and it's a crying shame as Matrix/Element (I no longer fully understand the difference/relationship between these entities) had a lot of potential.

Re: Verifying your Matrix devices is becoming mandatory

#25

Post by syntheticnature »

bfkwlfkjf wrote: post #6

Is this the ritual of getting together with a person and checking that their fingerprint match what you see on the app? If this is that case what will happen is that people will start verifying everyone (because they might want to text to strangers that they can't bother verifying because the stakes are so low) and so verification will lose all meaning.

It is not; I know we don't read articles here, but...

Re: Verifying your Matrix devices is becoming mandatory

#26

Post by kachapopopow »

iqihs wrote: post #23

I think Matrix as a protocol has been pretty ineffective, as their top priority seems to be keeping data permanent and duplicated. Both performance and privacy are at the bottom of their priority list. The one good thing I can say about it is that encryption of message contents is enabled by default in conversations and available in groups, but that's about it - nothing else is, or can be, encrypted. In other words,…

it's pretty on point, it's mostly a "trusted" platform as long as you trust the host with the messages between two people (or more?) being (optionally) encrypted.

Re: Verifying your Matrix devices is becoming mandatory

#27

Post by foresto »

tripdout wrote: post #3

What is verification? What does it involve doing? A lot of information on why it's useful, but how is it implemented? I hope it's not something like the Play Integrity API, but with no information to go on, I can't say either way.

In this case, it's what you do when signing in from a new device (or browser) to attest that it's yours. It avoids warnings to you and your contacts that a device has gained access to your account without your approval.

It involves doing one of these things:

- Comparing a short sequence of emoji on each device and confirming that they match.

- Using one device to scan a QR code displayed by the other.

- Entering a recovery key (a line of text) that you were given when you first set up the account.

Pretty quick and easy in most cases, although some clients can be glitchy in this area and require trying again.

(Gripe: The recovery key approach was unfortunately made painful and error-prone in recent Element releases, by disabling the option to choose a passphrase instead, but most people can simply use one of the other two approaches.)

Re: Verifying your Matrix devices is becoming mandatory

#28

Post by colordrops »

unbolted3032 wrote: post #24

I decommissioned my server 3 months ago and migrated my community back to IRC. I still had the IRC Podman containers kicking around, so that was easy. I dealt with ~monthly issues around my devices not being correctly verified, messages not correctly decrypting, and various other rough UX edges. There seemed to be a lot of velocity in the beginning but the last couple of years have addressed approximately nothing in…

The rough edges are too much for even very technical users and admins, so there's no way we're going to get friends and family to adopt this.

Re: Verifying your Matrix devices is becoming mandatory

#29

Post by prophesi »

kevincox wrote: post #19
hedora wrote: post #17

I don’t use Matrix, but if it’s E2EE, then how is it possible in the current design for an unverified device to even exist? It has the keys, or it doesn’t, right?

Matrix has E2EE support and many clients are pushing it as the default. But it also supports rooms that are only encrypted in transit.

That's correct, but E2EE also allows for unverified devices[0]. Key distribution and device verification are separate issues, and the former doesn't enforce the latter until April 2026 as they've announced in the HN article.

[0] https://matrix.org/docs/matrix-concepts/end-to-end-encryptio...

Post reply on HN