so, in riot.im/develop we now do verification by Short Authentication Strings (similar to ZRTP: https://github.com/matrix-org/matrix-doc/issues/1267 https://git

so, in riot.im/develop we now do verification by Short Authentication Strings (similar to ZRTP: https://github.com/matrix-org/matrix-doc/issues/1267 https://github.com/matrix-org/matrix-doc/issues/1267) and have QR codes on the horizon too (https://github.com/matrix-org/matrix-doc/pull/1544 https://github.com/matrix-org/matrix-doc/pull/1544). Meanwhile we also have cross-signing on the horizon, as demo'd in the OP: (https://github.com/matrix-org/matrix-doc/pull/1756 https://github.com/matrix-org/matrix-doc/pull/1756) so you only have to verify a user once and then transitively trust all their other devices automatically (assuming that user verified them when they logged in). This was a massive amount of work, but tantalising close. https://youtu.be/C2eE7rCUKlE?t=2836 https://youtu.be/C2eE7rCUKlE?t=2836 is the bit of the talk from FOSDEM which shows this being demo'd and (almost) working :) Edit: NFC would be cute, but it's not ideal from an evil maid perspective, and you'd have to tap to confirm that you verified the right user ID anyway. So personally QR codes ftw.