matrix-doc VS sydent

There is a "read the QR code visible on the other user's device" method for verifying (technical stuff).

This is a great example of why key-sharing exists today... and why it shouldn't. In theory, you should be able to pick up and old client and decrypt new messages and history on it absolutely fine. However, in practice, Matrix's E2EE publishes 100 one-time keys (OTKs) on your server to let other devices establish secure 1:1 channels with you if you're offline - and if you go offline and that pool of OTKs exhausts, then new sessions won't get set up and you won't receive keys for new messages... giving the misbehaviour you're seeing.

Now, you're right that key-sharing is a useful way to fudge around that failure mode.

But an even better way to fix it would be to find a way to stop the OTK pool exhausting - and that's precisely what MSC2732 is: https://github.com/uhoreg/matrix-doc/blob/fallback_keys/prop.... This provides a last-ditch key which can be used to set up 1:1 sessions even if you run out of OTKs, which is marginally inferior to using a different OTK every time, but in practice really isn't a disaster (see the MSC for details).

However, fallback keys are relatively new and aren't implemented on all clients yet (matrix-js-sdk has them, but matrix-ios-sdk is implementing this coincidentally this week)... and so until they land, we still need keyshare requests to paper over this limitation.

But in future, hopefully it will be almost unheard-of to need a keyshare request, and we can change them to be an entirely manual or out-of-hand mechanism of some kind, and avoid classes of bugs like the vuln in question here in future.

GitHub Discussions can also be a great place for support as long as these are regularly monitored. Another option along the same lines is Discourse and the Open Source Matrix which is used by quite a few Open Source and community-based projects.

Tangential: the article notes that Telegram is an “encrypted messaging app”. While this is technically true, it's worth keeping in mind that it's not end-to-end encrypted, so it's less secure in that regard than, say, Signal or even WhatsApp. Telegram does have opt-in end-to-end encrypted one-on-one chats, but those are very inconvenient to use.

For a properly encrypted chat app, including group chats (opt-in), try Matrix instead: https://matrix.org/

I'd love something like the Matrix [0] data model (JSON messages aggregated in an eventually-consistent chatroom CRDT) transmitted over something like simplex for metadata resistance.

[0] https://matrix.org

Trillian mod here. There's this new thing called Beeper, works on matrix.org. It's not as the good old times, but I'm currently using whatsapp, FB messenger, discord, telegram, signal, imessage and a few more. It's not Cerulean experience, but it's... slowly improving.

I'm trying to change my account provider from "matrix.org" to whatever Element One needs, and for the life of me I just don't understand what values I have to put where to be able to log in. I tried `element.io`, which takes me to sso.element.io but this doesn't seem like the right thing (no credentials work as I expect.