Authenticity warning on new messages

[lnicola]

Description

I'm getting this message in a one-to-one chat. Both of us are using our own homeservers and have cross-signed our sessions (as far as we can tell). We've also verified each other.

But new (not old as in element-hq/element-web#14323) messages still have that badge:

I'm sure the message means something, but it's unactionable -- it doesn't tell me what I need to do.

Version information

• Platform: web

For the web app:

• Browser: Firefox 87
• OS: Linux
• URL: element-web 1.7.18

[jryans]

@lnicola Can you please send debug logs as well and mention this issue? Those will quite valuable in diagnosing what's happening here.

[lnicola]

I did.

[jryans]

Ah okay indeed, they weren't linked up automatically since the issue number was used instead of the full link. Thanks, we'll take a look.

[lnicola]

Ah, sorry, I missed the URL in the placeholder text.

[jryans]

Ah, sorry, I missed the URL in the placeholder text.

No worries, it's not the most intuitive process... 😅

[sisko-1]

Hello,

I have the same issue with the the desktop client on Windows (v 1.7.20).

[jryans]

@lnicola Are you continuing to see this issue for all new messages on the same session from your original report?

[lnicola]

@jryans I think I still see it in the same chat from that session. In another session I don't get the badge. But the problematic one was fresh, so I don't know what's wrong with it.

In another session I don't see the warning, and I still don't know what it means.

[jryans]

I'm sure the message means something, but it's unactionable -- it doesn't tell me what I need to do.

As far as what it means, it's the same as described in https://github.com/vector-im/element-web/issues/14323#issuecomment-740855963: the keys to decrypt the messages with gray shields came from either key backup or from another session, rather than directly to the current session. There's nothing that you can do, it's just letting you know.

So this is very similar to https://github.com/vector-im/element-web/issues/14323, but it remains somewhat surprising to continue seeing these shields on a new session for new messages long after the session was initially added, so that's why I've left this open separately for the moment.

[waclaw66]

Same issue here, Element Web 1.7.22. Gray shield appears in newly created sessions next to all already existing encrypted messages. Ahh sorry, my problem is more likely element-hq/element-web#14323.

[bjonnh]

Same issue here, one of my sessions on android makes the other users not able to see my messages. And I see them with a grey shield on the web version. All my sessions are green and trusted if I click on the username…

[kevincox]

I just set up two new devices and had the issue occur on both. I have sent debug logs from both devices. I tried clearing the cache of one device but it didn't change anything. In both cases I set up using an e2e key rather than from another device.

[kevincox]

This is still happening on both devices. I have send debug logs again. Let me know if I can do anything else to help debug.

[TeknikalDomain]

This is affecting me as well, and I've got to agree with OP on this one: the message is unactionable, and only (seems to) serve as a warning of something that I can't control, and, for that matter, can't "fix."

[f35f0ef9d0e827dae86552d3899f78fc]

For me, the problem is only happening in one room. All rooms on the server are encrypted. This room in particular has multiple members, some of which are verified and some are not. All of my devices are verified. I logged out / in of one of the Element Web clients recently. Now, messages from my mobile device have the grey shield in this one room. Perhaps I should sign out / in with that device, too?

I have tested other rooms where the problem does not happen:

• A private room where I am the sole member
• A private chat with one other person, verified
• A different private chat with one other person, verified
• A public room with multiple people, all verified

Without knowing the code, the behavior makes me surmise that one of the unverified room members shared the key when I logged back in.

I want to believe: oh, I destroyed the original session that trusted the mobile device, so the chain of trust is lost, however that doesn't make sense when I don't have the grey shield in most rooms.

Maybe of note is the room with the problem is one of the oldest rooms on the server.

[kittykat]

Duplicate of element-hq/element-web#14323

[Avamander]

So this is very similar to element-hq/element-web#14323, but it remains somewhat surprising to continue seeing these shields on a new session for new messages long after the session was initially added, so that's why I've left this open separately for the moment.

I'm seeing this on all new messages from a verified conversation partner on one specific device. The messages are without the warning elsewhere. Would logs be useful to help get rid of this?

[SimonBrandner]

Duplicate of element-hq/element-web#14323

Closing as a duplicate

[SimonBrandner]

So this is very similar to element-hq/element-web#14323, but it remains somewhat surprising to continue seeing these shields on a new session for new messages long after the session was initially added, so that's why I've left this open separately for the moment.

I'm seeing this on all new messages from a verified conversation partner on one specific device. The messages are without the warning elsewhere. Would logs be useful to help get rid of this?

Maybe, please send logs to https://github.com/vector-im/element-web/issues/14323

[Avamander]

@SimonBrandner This issue is about new messages, element-hq/element-web#14323 is about old messages.

[SimonBrandner]

Ah, sorry for closing too quickly, thanks for letting me know!

[f35f0ef9d0e827dae86552d3899f78fc]

I ran into this behavior yet a second time. I got it to go away and here is how. I did two things, and I'm unfortunately not certain if both are required.

1. Log out of Element (yes, again, even though this is what caused the problem in the first place).
2. Close the Element program completely.
3. Re-open and log in.
4. Perform device trust with another trusted device. I chose another desktop instead of mobile device.
5. Go to Security & Privacy settings on your new session and delete your "device" that you logged out of in step 1.

New messages no longer have a grey shield! Old ones do, but that is expected behavior at this point and I can live with it.

[UmbraChimera]

I tried what @f35f0ef9d0e827dae86552d3899f78fc advised, and it's still happening. Even with a whole new account I made. Any suggestions?

[lanerussell]

Has this issue been addressed? This is still a frequently occurring problem. I opened a separate issue about this back in Feb. 2021 (#16336) when I was getting grey shields even on messages I sent from my own devices. These devices have been logged in for several weeks and had been sending messages cleanly previously. Out of the blue, I just started getting grey shields.

Also interesting that I get grey shields on my messages only in some rooms. Either my devices trust each other, or they don't, right?

The same is true of some of my contacts. Sometimes person A will have a grey shield in one room, but won't in another.

@f35f0ef9d0e827dae86552d3899f78fc's advice usually also works for me, but that isn't really something I can ask my user's to do every few weeks when Element web/mobile bugs out. This issue has also been slowly eroding my trust in the reliability and security of Element's encryption. If my devices keep forgetting who they trust, what else might be going wrong under the hood?

[lanerussell]

Any updates here @SimonBrandner ? Now seeing grey shields on alternating messages in some cases. This issue should probably be escalated as it seems to be getting worse with recent releases and directly impacts people's impressions of Element's E2EE trustworthiness.

[sbrooke]

I just did a migration from an Intel platform to an Arm64 platform and everything seems to be working except this. The desktop client doesn't trust my own messages I send from other devices now. It all works, just not sure what to do about it.

[dasJ]

This is still an issue today. I do understand why the gray shield appears (I logged into the machine and got the keys from another device) but I do not get the purpose of the shield. What is the benefit of me knowing the key came from one of my trusted devices? I already trust it and there is no button in Element to say "yes I really, really, really trust it please just remove the shield".

While I don't see any point in that functionality, it also lacks consistency. I had a conversation with a coworker complaining about this exact issue and at some point his messages just started lacking the shield again. What happened? Did the keys origin suddenly change to my local device? This is puzzling to me and actually lowers my trust into the functionality which additionally seems pointless to me.

[SirCypher]

Got the shield randomly a few days ago when messaging a friend, even though nothing changed. No device was added/deleted. All devices trust each other and "everything is green" on both sides, except that messages from one of my devices are now marked with that shield when my friend reads them.

[vexed-one]

This is a design flaw in the UI, in that if you're a normal everyday user and sees the little gray shield, they think something is wrong.

Trust is lost because of this and nobody wants to use it anymore since they think it is broken.

I can' t believe this hasn't really been address for years, it is like you want people that aren't particularly tech savvy , to understand the rational behind this where there really isn't a good reason to display the gray shield unless of course there is an actual problem with the message.

[jtrees]

Just FYI: I'm running into this on Element Android too. So perhaps it's a protocol issue?