The most useful room history option for E2EE is missing: "Members only (last 10 messages up to when they joined)" (or similar)

[ell1e]

Is your suggestion related to a problem? Please describe. At the moment, social E2EE rooms (=wider not fully trusted audience) are a pain to configure such that they are practical to use but also at least somewhat secure from the unencrypted logs being available to everyone, everywhere which obviously ruins the point of E2EE.

The problem is that sometimes the encryption catches up too slowly, which means with room history "Members only (since they joined)" after joining people can not always read a direct greeting message to them. Even worse, if there is no immediate greeting they might think the room is dead / have no idea what it is about and leave again if they have absolutely no scroll back for context. But "Members only (since the point in time of selecting this option)" just ruins the point of E2EE, since at best one can see somebody siphoned all the logs but even older messages aren't safe.

I think the most useful attack scenarios to defend from using E2EE in semi-public community rooms are: 1. some gov agency suddenly has an interest in the people in this room and wants to grab all the past history because why not, 2. a concrete incident like a past message that is now considered problematic made its way to either the press or to some group looking to make a mob about it and now somebody is trying to find an easy way to get it from the logs as proof, assuming existing channel members would not necessarily easily share these logs with external troublemakers now searching for it. (Which obviously won't always be the case, but will be sometimes.) I think the more paranoid of attack scenario of 1. "somebody evil can join and grab the super secret messages as we talk" isn't really possible to defend against for social channels with E2EE anyway, since there isn't usually a good overview of who's even in the room that might not be trustworthy, same as the attack scenario of 2. a targeted gov agency interest for future messages in such a relatively open room.

Now for the above attack scenarios that are still reasonable to secure users from, "Members only (since the point in time of selecting this option)" fails all of these. "Members (since they joined)" passes them but is impractical for the above problems for new people joining.

This is where "Members only (last 10 messages up to joining)" comes in (or something alike). It would fix the practicality issues, and still retain the security for all the above cases unless it concerns something extremely recent in the last 10 messages. I therefore strongly believe it is one of the best default settings there could be, but it doesn't exist. I therefore suggest it should be added.

Describe the solution you'd like Something like "Members only (last 10 messages up to joining)", which is a reasonable compromise for rooms that want to keep members still as safe as possible while avoiding the problems of new joiners missing greetings or context entirely.

Describe alternatives you've considered not using e2ee for social rooms at all, but I fail to see how that is better

Additional context Add any other context or screenshots about the feature request here.

[ShadowJonathan]

I'm quite sure this needs an MSC, but we'll see where this goes.

[jryans]

I would suggest discussing this in the form of MSC as @ShadowJonathan mentioned. #matrix-spec:matrix.org may have some useful advice.