3 ms·

After spending several months convincing a few friends to use Riot, the ongoing fiasco with E2E has caused all of them to leave within a couple of days. Obvious

After spending several months convincing a few friends to use Riot, the ongoing fiasco with E2E has caused all of them to leave within a couple of days. Obviously they're unlikely to ever come back. It's a real shame. These are technical people who don't particularly mind verifying a key by hand. In fact I personally even prefer it. The problem is not only that certain things are not done automatically, but that the UI is designed to make it difficult to do them even manually! E.g., I have one device 'foo' which you already trust. I add a new device 'bar'. Why on earth would you want to verify its key manually when I could just send you the new key from 'foo' which you already trust? Even worse, the key for 'bar' is not straightforwardly available anywhere in the UI on device 'foo'. It should be easily viewable in the right hand pane where the list of devices is, but it's not. The only way to get the device ID and key is to send a message from 'bar' to 'foo' and view the details of the message. Why?

uhoreg 7y ago
> E.g., I have one device 'foo' which you already trust. I add a new device 'bar'. Why on earth would you want to verify its key manually when I could just send you the new key from 'foo' which you already trust? This particular issue is being worked on right now in Riot, and should be fixed early in the new year.
- boring_twenties 7y ago
  That is awesome, but any thoughts on why I cannot easily view the keys of my other devices in the UI? If I could then this would be a minor inconvenience at best, I'd just copy/paste the key from the already-trusted device.
  - Arathorn 7y ago
    I guess we just prioritised working on cross-signing etc rather than adding in UI for this. Sorry; it's an oversight.
    - boring_twenties 7y ago
      Thank you for your quick and patient answers to my perhaps too demanding questions. Cross-signing is obviously better, no question about that. However this simple UI change would be at least 95% as good, and certainly good enough to have prevented my friends from giving up on Riot. I hope that is at least somewhat constructive. Thank you for your work.
      - Arathorn 7y ago
        I guess https://github.com/vector-im/riot-web/issues/2735 https://github.com/vector-im/riot-web/issues/2735 is the bug to upvote. Annoying it's been stuck open forever :(
kethinov 7y ago
> Obviously they're unlikely to ever come back. I recognize this is a common attitude, but it makes no sense to me. Some software you tried today isn't designed in a way you prefer, so you go back to using something else. Okay. Makes sense. But to declare the whole project forever hopeless as if it can never be improved upon because the snapshot of your first experience with it was negative is truly irrational.
- wvyar 7y ago
  I think it's less that people assume that it can never be improved and more that they find something else that is "good enough" and they won't leave that ecosystem until it stops being good enough. Generally speaking, I've found others (and myself, at times) don't re-evaluate their options until there's a need for them to upgrade or its brought to their attention by someone else.
- boring_twenties 7y ago
  Keep in mind the only reason they tried the software is that I regularly pressured to do so for months, before they finally caved. After all that they quickly come to realize that something simple like adding a new device is a massive pain in the ass. It's not that they declare the whole project as forever hopeless, it's that they invested time and effort into trying it already and it turned out (for them) to be a waste. It's just a bad taste left in the mouth. In order for them to try it again, they not only have to overcome their natural laziness/time constraints, but also the rather unpleasant memory of the last time.
  - sjy 7y ago
    The same thing happened to me, but I am thinking of having another go and just discouraging the use of E2EE. (The community I’m thinking of is currently on Slack, so there would be no marginal loss of privacy.) Have you considered that, or is your group already using another E2EE platform that isn’t a massive pain in the ass? I’ve yet to discover one myself.
    - boring_twenties 7y ago

uhoreg 7y ago

> E.g., I have one device 'foo' which you already trust. I add a new device 'bar'. Why on earth would you want to verify its key manually when I could just send you the new key from 'foo' which you already trust? This particular issue is being worked on right now in Riot, and should be fixed early in the new year.

boring_twenties 7y ago
That is awesome, but any thoughts on why I cannot easily view the keys of my other devices in the UI? If I could then this would be a minor inconvenience at best, I'd just copy/paste the key from the already-trusted device.
- Arathorn 7y ago
  I guess we just prioritised working on cross-signing etc rather than adding in UI for this. Sorry; it's an oversight.
  - boring_twenties 7y ago
    Thank you for your quick and patient answers to my perhaps too demanding questions. Cross-signing is obviously better, no question about that. However this simple UI change would be at least 95% as good, and certainly good enough to have prevented my friends from giving up on Riot. I hope that is at least somewhat constructive. Thank you for your work.
    - Arathorn 7y ago
      I guess https://github.com/vector-im/riot-web/issues/2735 https://github.com/vector-im/riot-web/issues/2735 is the bug to upvote. Annoying it's been stuck open forever :(

kethinov 7y ago

> Obviously they're unlikely to ever come back. I recognize this is a common attitude, but it makes no sense to me. Some software you tried today isn't designed in a way you prefer, so you go back to using something else. Okay. Makes sense. But to declare the whole project forever hopeless as if it can never be improved upon because the snapshot of your first experience with it was negative is truly irrational.

wvyar 7y ago
I think it's less that people assume that it can never be improved and more that they find something else that is "good enough" and they won't leave that ecosystem until it stops being good enough. Generally speaking, I've found others (and myself, at times) don't re-evaluate their options until there's a need for them to upgrade or its brought to their attention by someone else.
boring_twenties 7y ago
Keep in mind the only reason they tried the software is that I regularly pressured to do so for months, before they finally caved. After all that they quickly come to realize that something simple like adding a new device is a massive pain in the ass. It's not that they declare the whole project as forever hopeless, it's that they invested time and effort into trying it already and it turned out (for them) to be a waste. It's just a bad taste left in the mouth. In order for them to try it again, they not only have to overcome their natural laziness/time constraints, but also the rather unpleasant memory of the last time.
- sjy 7y ago
  The same thing happened to me, but I am thinking of having another go and just discouraging the use of E2EE. (The community I’m thinking of is currently on Slack, so there would be no marginal loss of privacy.) Have you considered that, or is your group already using another E2EE platform that isn’t a massive pain in the ass? I’ve yet to discover one myself.
  - boring_twenties 7y ago