Posted by LorenDB 11/20/2025
We have a space with several rooms for our FOSDEM devroom, it's been working flawlessly, including for all our video calls with many participants. Thanx Element team!!
Unverified devices are indistinguishable from a hacker logging in through credential stuffing/password leaks until verification is done.
It's a process similar to adding devices to Signal or WhatsApp, except with Matrix you can still log in without having physical access to another device. Useful if you only ever visit unencrypted rooms perhaps.
Matrix is something that had my eyes lit after years or being burnt/disappointed by communication apps (Signal included). I had converted/migrated a lot of people to it (I mean of course they didn't "convert" but they had it and were replying to me) from a country where WhatsApp is essentially "basic need" today – along with water, air, food, and shelter and that too in an era when it was not even stable. After that I just didn't know what the hell happened. Matrix, Vector, Riot, Element – things just kept happening. App was never an end user app and it became very clear that it was not the intention either. To be honest it didn't look like a replacement for something like Slack or something like IRC either. It was trying to become something which it seemed/seems has no end goal or destination i.e a clear roadmap. As if the goal is to develop cool features and just put them haphazardly together which I am afraid often results in something Mary Shelley wrote.
I still login from time to time and I don't understand what is happening. Something I see this notification, something that, sometimes I see there's a message pending, sometimes I see I have a chat recovered (old/stale; because there's no one I know uses it anymore), sometimes I see a certain chat is not recovered because some verification or decryption (or something) failed, sometimes I see (or understand it) that I might another active and verified device to recover certain messages. I had created some groups and of course they remain abandoned - but no, few og them were filled were porn and the kind of some was scary because that vector/riot/element account is connected to my real ID including the email and I was scared shitless. I tried deleting them but I couldn't. Next time I will try harder or just try to make it private after kicking everyone out. I will still keep the account. Never say never :)
I sadly have moved from writing enthusiastic to sad to disappointing comments to not even paying attention to it when there's a Matrix/Element news now. I think I don't even notice it. I think that's the worse kind of eventuality in this context. Anyway, I wish you all luck and I am sure you all know what you are doing.
Element X definitely is.
It has the keys, or it doesn’t, right?
[0] https://matrix.org/docs/matrix-concepts/end-to-end-encryptio...
One of the better comparisons out there: https://www.freie-messenger.de/en/systemvergleich/xmpp-matri...
XMPP also does E2EE of course, though I've found it to be a worse experience on most clients compared to Matrix.
My matrix server isn't even publicly accessible and users can't sign up. I don't federate with the network. So these issues are irrelevant to me. There should still be a way to turn it off. Because many of the bridge bots I run can't verify.
The code examples I'm aware of for clients using the first-party library also leave verification and E2EE out, FWIW.
Because it sounds like "we'll put them in a database so we can sell it" to me...
Where is that data stored?
What happens if I'm on holiday in Paris and drop my phone, which is the only device I have with me, in the Seine?
Sounds like more passkeys security theater/inconvenience to me.
> What happens if I'm on holiday in Paris and drop my phone, which is the only device I have with me, in the Seine?
1) use your recovery key (to recover your identity (prooven by private keys) from the server) - I believe it only works if you enabled server side key storage
Or
2) create a new identity (contacts will be notified)
Or
3) wait until you have access to another device again
Source of truth: https://spec.matrix.org/v1.16/client-server-api/#cross-signi...