You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This is a tracking issue for turning on E2EE by default. This means merging matrix-org/matrix-js-sdk#2002 and then using it for todevice signalling in element-call.
In practice, I think can go ahead and do this without further delay, because:
The rageshake reporting operates in terms of unencrypted messages, so we should be able to debug irrespective of E2EE assuming that to-device is working okay.
Even if we do see to-device messages disappearing on the server, we can chase them through as opaque blobs anyway.
However, it's worth noting that E2EE is useless without verification. As a first cut we could do TOFU and persist the verification state in localstorage, but obviously this will not help us with a preexisting attack or impersonator, which would be pretty easy, not least given we're currently spinning up new user IDs everywhere rather than inheriting existing trust. I'll file a separate bug for that.
The text was updated successfully, but these errors were encountered:
This is a tracking issue for turning on E2EE by default. This means merging matrix-org/matrix-js-sdk#2002 and then using it for todevice signalling in element-call.
In practice, I think can go ahead and do this without further delay, because:
However, it's worth noting that E2EE is useless without verification. As a first cut we could do TOFU and persist the verification state in localstorage, but obviously this will not help us with a preexisting attack or impersonator, which would be pretty easy, not least given we're currently spinning up new user IDs everywhere rather than inheriting existing trust. I'll file a separate bug for that.
The text was updated successfully, but these errors were encountered: