element-hq / element-meta

Shared/meta documentation and project artefacts for Element clients
65 stars 11 forks source link

Client functionality for detecting and warning about impersonations #2437

Open makoConstruct opened 3 weeks ago

makoConstruct commented 3 weeks ago

Your use case

What would you like to do?

See a warning when I see someone with the same or a very similar (replacing I with l, that kind of thing) username as someone else I have interacted with.

How would you like to achieve it?

Have the client maintain a list of the usernames the user has interacted with in the past and their full matrix address. Interaction includes sending messages in the same channel as another user in immediate succession, before or after, replying, reacting, or DMing.

Each time the user sees a new user, check the list for similar names and display a warning if the listed full matrix address doesn't match the address of the existing entry on the list. The user can dismiss the warning, which adds the new user to the list as another person who's allowed to have that user name.

Have you considered any alternatives?

"Petnames" provide a similar function, where the user sets a name for their contacts, and unset names are rendered with a warning, but my approach doesn't require the user to take so many manual actions. I also think showing a warning for every single new user you encounter would be exhausting and users would tend to just learn to ignore them.

I came across a suggestion that element's random username colors have something to do with security, I'm guessing it's about this? An impersonator doesn't know or control which color will be shown on their username, so a user will generally be able to spot an impersonator by the color difference. However, this is far too subtle. Imagine if someone came to you saying that they got phished, and you said to them "You should have noticed that the username color was different :3". It's kind of not a reasonable way of communicating that impersonation might be happening.

Believe it or not, many people don't remember the color of their friends' eyes, because it is usually not useful information. I'm sure many people wont remember username colors, but would they notice when there's a change? Possibly. It just. Doesn't seem like a great approach. It also means that the username color will usually be mismatched with the user icon, which doesn't look good.

Additional context

No response