Top
Best
New

Posted by LorenDB 11/20/2025

Verifying your Matrix devices is becoming mandatory(element.io)
210 points | 242 commentspage 2
teekert 11/20/2025|
I love Martix/Element, and about the only thing I don't like is that I need moar features!

We have a space with several rooms for our FOSDEM devroom, it's been working flawlessly, including for all our video calls with many participants. Thanx Element team!!

Bayaz 11/20/2025||
I have a private matrix server for a few friends. Whenever someone logs on with a new device or client it lists them as being unverified. Eventually it goes away. I really have no idea at what point verification occurs.
jeroenhd 11/20/2025|
They verify their device. Usually means opening Matrix on a other device, clicking the pop-up, and scanning a QR code or matching emoji. One device signs proof of verification of the other and exchanges encryption keys so the new device can read encrypted conversations.

Unverified devices are indistinguishable from a hacker logging in through credential stuffing/password leaks until verification is done.

It's a process similar to adding devices to Signal or WhatsApp, except with Matrix you can still log in without having physical access to another device. Useful if you only ever visit unencrypted rooms perhaps.

crossroadsguy 11/20/2025||
I am not sure the founder is reading this. I tried googling but couldn't find it - I recall the hn handle being something like Atheon. Not that hn sends mention notifications.

Matrix is something that had my eyes lit after years or being burnt/disappointed by communication apps (Signal included). I had converted/migrated a lot of people to it (I mean of course they didn't "convert" but they had it and were replying to me) from a country where WhatsApp is essentially "basic need" today – along with water, air, food, and shelter and that too in an era when it was not even stable. After that I just didn't know what the hell happened. Matrix, Vector, Riot, Element – things just kept happening. App was never an end user app and it became very clear that it was not the intention either. To be honest it didn't look like a replacement for something like Slack or something like IRC either. It was trying to become something which it seemed/seems has no end goal or destination i.e a clear roadmap. As if the goal is to develop cool features and just put them haphazardly together which I am afraid often results in something Mary Shelley wrote.

I still login from time to time and I don't understand what is happening. Something I see this notification, something that, sometimes I see there's a message pending, sometimes I see I have a chat recovered (old/stale; because there's no one I know uses it anymore), sometimes I see a certain chat is not recovered because some verification or decryption (or something) failed, sometimes I see (or understand it) that I might another active and verified device to recover certain messages. I had created some groups and of course they remain abandoned - but no, few og them were filled were porn and the kind of some was scary because that vector/riot/element account is connected to my real ID including the email and I was scared shitless. I tried deleting them but I couldn't. Next time I will try harder or just try to make it private after kicking everyone out. I will still keep the account. Never say never :)

I sadly have moved from writing enthusiastic to sad to disappointing comments to not even paying attention to it when there's a Matrix/Element news now. I think I don't even notice it. I think that's the worse kind of eventuality in this context. Anyway, I wish you all luck and I am sure you all know what you are doing.

tcfhgj 11/20/2025|
> Matrix, Vector, Riot, Element – things just kept happening. App was never an end user app and it became very clear that it was not the intention either.

Element X definitely is.

lousken 11/20/2025||
"The authenticity of this encrypted message cant be guaranteed on this device" both sides verified, but this still randomly pops up, what happens then? will i lose those messages in the future?
Arathorn 11/20/2025|
No, it's just a warning that your client can't prove that the message was really sent by that sender. These will eventually go away once https://github.com/matrix-org/matrix-spec-proposals/pull/404... lands.
pqs 11/20/2025||
I've been using Delta Chat with a lot of success. It is easy, it works, bots are easy and the concept is improving. They even plan to have forward secrecy. So, give it a try. If you explored it a long time ago, try again, many things have improved in that ecosystem.
josephb 11/21/2025|
Yeah it's a lot more "just works" than Matrix, still some limitations but improving quickly.
kuon 11/20/2025||
I really want to love matrix but it always turned bad/broken at some point. I switched to XMPP. No issue ever, but the clients are not very good.
hedora 11/20/2025||
I don’t use Matrix, but if it’s E2EE, then how is it possible in the current design for an unverified device to even exist?

It has the keys, or it doesn’t, right?

kevincox 11/20/2025||
Matrix has E2EE support and many clients are pushing it as the default. But it also supports rooms that are only encrypted in transit.
prophesi 11/20/2025||
That's correct, but E2EE also allows for unverified devices[0]. Key distribution and device verification are separate issues, and the former doesn't enforce the latter until April 2026 as they've announced in the HN article.

[0] https://matrix.org/docs/matrix-concepts/end-to-end-encryptio...

bigstrat2003 11/20/2025||
You don't have to use E2EE if you don't want to. I personally don't because I don't care about it, and it adds extra difficulties to the experience.
throwaway290 11/20/2025||
If you don't need e2ee, are there features that make matrix better than xmpp?
toastal 11/20/2025|||
Both XMPP (via OMEMO) & Matrix use libsignal for double-rachet encryption—so they have the same encryption properties. The biggest practical differences for the average user in my opinion is XMPP has a separate concept for DMs (not a 2-user room with encryption like Matrix), XMPP allows encryption to be both enabled then later disabled, & Matrix offers better resilience as messages & attachments get synced to all servers a room (which has a massive downside of resources, storage sizes, & moderation; if a server goes offline, you still have a history of the chat but if someone shares something explicit, such as CP, it will propagate thru the network & there is no way to delete it across nodes).

One of the better comparisons out there: https://www.freie-messenger.de/en/systemvergleich/xmpp-matri...

jeroenhd 11/20/2025||||
Lots of open source projects have matrix servers and not XMPP servers. Some bridges don't have XMPP equivalents (and some bridges don't have Matrix equivalents either).

XMPP also does E2EE of course, though I've found it to be a worse experience on most clients compared to Matrix.

tcfhgj 11/20/2025|||
decentralized rooms, built in video conferencing, consistent chat history storage
wkat4242 11/20/2025||
Ugh.. I loved Matrix but I'm starting to hate the way they force these things through. Also last month they removed the categories (People, Rooms, Favourites) from Element Web just like that. Making it very hard to use as I use it. I had to roll back to an older version. They seem to be focused on whatever commercial or consumer experience but they are ruining it for power users.

My matrix server isn't even publicly accessible and users can't sign up. I don't federate with the network. So these issues are irrelevant to me. There should still be a way to turn it off. Because many of the bridge bots I run can't verify.

solarkraft 11/20/2025||
This is a good thing. It is (was?) all too inviting to leave clients unverified because verification is (was?) hard and annoying.

The code examples I'm aware of for clients using the first-party library also leave verification and E2EE out, FWIW.

nottorp 11/20/2025|
From an outsider's point of view, what is this "verifying"?

Because it sounds like "we'll put them in a database so we can sell it" to me...

tcfhgj 11/20/2025|
cryptographic process to poof that the devices you use in fact belong to you (as cryptographic identity)
nottorp 11/21/2025||
To poof to who?

Where is that data stored?

What happens if I'm on holiday in Paris and drop my phone, which is the only device I have with me, in the Seine?

Sounds like more passkeys security theater/inconvenience to me.

tcfhgj 11/21/2025||
To your contacts; if I understand correctly, the public keys are uploaded to the server

> What happens if I'm on holiday in Paris and drop my phone, which is the only device I have with me, in the Seine?

1) use your recovery key (to recover your identity (prooven by private keys) from the server) - I believe it only works if you enabled server side key storage

Or

2) create a new identity (contacts will be notified)

Or

3) wait until you have access to another device again

Source of truth: https://spec.matrix.org/v1.16/client-server-api/#cross-signi...

More comments...