Option to only send encrypted messages to verified devices

[richvdh]

Probably at the per-room level. Shared across all users, or per-user?

[vext01]

We've just discussed this very issue.

It worries me that an unverified party can silently intercept encrypted messages undetected.

[vext01]

We've just discussed this very issue.

It worries me that an unverified party can silently intercept encrypted messages undetected.

[vext01]

And this is not a bug unique to vector-web

[vext01]

And this is not a bug unique to vector-web

[ArdaXi]

I would suggest having this per-user. Primarily because it empowers the user to increase security for their own messages without having to have the necessary room privileges.

Would be nice if this were supported for the entire room as well, but that's a Matrix spec issue too.

[ArdaXi]

I would suggest having this per-user. Primarily because it empowers the user to increase security for their own messages without having to have the necessary room privileges.

Would be nice if this were supported for the entire room as well, but that's a Matrix spec issue too.

[ara4n]

Just to confirm: this is very much on our radar, but we're also having to juggle all other issues coughed up by the beta - i.e. the Unknown Inbound Session ID bugs, verifying devices, and giving folks the ability to backup & restore E2E state. It will be coming RSN, and yes, it does pose a serious issue (as do the others).

[ara4n]

Just to confirm: this is very much on our radar, but we're also having to juggle all other issues coughed up by the beta - i.e. the Unknown Inbound Session ID bugs, verifying devices, and giving folks the ability to backup & restore E2E state. It will be coming RSN, and yes, it does pose a serious issue (as do the others).

[ara4n]

i did this.

[ara4n]

i did this.