Configuration option to hide (or put somewhere less prominent again) the "unverified devices in the chat" message

[litui]

Feature Description

An option, ideally appearing in the end user's account settings (under Chat or Security, ideally) or the per-room Encryption settings allowing the "unverified devices in the chat" notification to be hidden.

Found #3140 but my needs are a touch different and the same solution doesn't apply.

Rationale

The "unverified devices in the chat" message present in v2.7.2 is proving needlessly stressful to both my users and to me in trying to provide reassurances about what it means to them. The message currently takes up space and appears directly above the text entry box in an encrypted chat room at all times when there are outstanding keys owned by anyone in the room that have not yet been signed.

I get that this heads up is a sensible default and generally a positive thing that treats the device trust relationships as paramount when encryption is turned on, but different communities have different risk surfaces they're addressing. Within mine, it's not such a big deal for devices to be left unverified (when trying out different clients, etc.). E2E encryption is turned on for us mainly to prevent passive snooping (e.g.: workplaces doing certificate MITM, etc.) and to prevent server-side storage of unencrypted chats.

We are a small group and our communication privacy is not so critical we need to be super worried about compromised cilent keys, we simply prefer privacy. Allowing end users to disable the notification either globally or chat-by-chat would be appreciated.

Mockup

No response

Additional Context

No response

[krille-chan]

Why don't you just take care of the unverified devices? You don't need to verify each other for it. Just enable the chat backup on every device and delete no longer used devices and then you are fine

[litui]

Why don't you just take care of the unverified devices? You don't need to verify each other for it. Just enable the chat backup on every device and delete no longer used devices and then you are fine

Working on it, but I can already see it's going to happen again and again and we'll be back to the same routine of panicking and trying to educate, etc. It's a hurdle to usability in our case more than it's of immediate benefit.

[krille-chan]

Hmm, but if I would add an option to disable it you would also educate everyone how to find this config so sounds like education is possible. In the future the chat backup will be mandatory anyway and unsigned devices will be ignored. Then the error message will disappear... but you would also then no longer be able to read messages on unsigned devices

[krille-chan]

Also if you don't care about encryption, you can still create unencrypted rooms. If you don't care about trusted devices then a corrupted server can do a man in the middle attack and read everything anyway so the encrypted messages in the db are not a security layer anyway :-(

[litui]

Hmm, but if I would add an option to disable it you would also educate everyone how to find this config so sounds like education is possible. In the future the chat backup will be mandatory anyway and unsigned devices will be ignored. Then the error message will disappear... but you would also then no longer be able to read messages on unsigned devices

It is way easier to tell users to "click this button to make the message go away forever" than to walk them through an explanation of the process of iterating through and verifying all their devices.

I'm glad the chat backup will be mandatory at some point.

Also if you don't care about encryption, you can still create unencrypted rooms. If you don't care about trusted devices then a corrupted server can do a man in the middle attack and read everything anyway so the encrypted messages in the db are not a security layer anyway :-(

A corrupted server is not the model I'm working against here as these channels are largely internally used. Federation will eventually factor in but again, that's not the model that's most immediately concerning to us. Yes, perfect encryption with perfect trust is ideal, but there are always usability tradeoffs.

Anyway, I've put forward my needs and rationale. One can disagree which is fair, but I would also argue that options are important especially when a prominent, persistent notice is only a helpful feature (in most cases) and not an essential part of your app's security model.

[krille-chan]

I can understand your needs 😞 I mean before there was an encryption icon in the top right with an orange or red warning sign. I would have expected that this would be more intrusive than a state message at the bottom of the chat with no colors at all. I guess the problem is that it blocks some space on the screen all the time.

You could actually just go to settings > security and set "share keys with" to "cross signed if available". Then this message would also disappear but all devices not connected to the chat backup would no longer be able to read messages. This will be the default very soon together with making chat backup mandatory. Would that be an option?

I could also start making the char backup mandatory from the next release on (as element x us doing it as well this should be fine)

[litui]

I can understand your needs 😞 I mean before there was an encryption icon in the top right with an orange or red warning sign. I would have expected that this would be more intrusive than a state message at the bottom of the chat with no colors at all. I guess the problem is that it blocks some space on the screen all the time.

Yes, it's more the perception that it's in the way or taking up space where it is now, and there's a growing level of frustration given some users are new and not as well versed on the cryptography side of things. When the only option they have after validating their own keys is to block others' keys (without a clear understanding of what that means, or what those device keys even truly represent) I think this misses the mark on end user experience just a bit.

This is an aside actually, but it's unclear what "Signed" means to some users when the notice is about "verified" devices... perhaps that could be made clearer to folks with less understanding of encryption too.

You could actually just go to settings > security and set "share keys with" to "cross signed if available". Then this message would also disappear but all devices not connected to the chat backup would no longer be able to read messages. This will be the default very soon together with making chat backup mandatory. Would that be an option?

If it becomes a seamless default with a mandatory wizarded process (compatible with other clients) to ensure everybody is brought into the fold with minimal hassle, then absolutely this would work. I wouldn't argue against greater security as the default, just it needs to flow well and mostly be handled out of sight for the average person.

I could also start making the char backup mandatory from the next release on (as element x us doing it as well this should be fine)

Again, as long as the onboarding is smooth and plays nice with other clients (if folks are onboarded smoothly then my users and I will never even have to have these conversations, and education can happen more gradually over time). Our default web experience for users right now is Sable, which admittedly is missing some of that mandatory encryption onboarding still [it might be present for the standard registration flow, but we're doing the SSO thing so I haven't tested...]. Of all the mobile clients I tested, FluffyChat seems to have the best support for the extensions and user experience of Sable (though far from identical).

[litui]

Aside, if MSC4268 is in the pipeline to support between FluffyChat users in a streamlined way that'd also kick ass, but if not I can make a low priority feature request of that too.