4 ms·
I’ve never said this is “only an issue for malicious homeservers”. I said that if you want to be sure who’s in your group you need to verify their identity, at
by Arathorn 1y ago
I’ve never said this is “only an issue for malicious homeservers”.
I said that if you want to be sure who’s in your group you need to verify their identity, at which point you get warned very clearly if malicious devices get added and most clients will refuse to send messages in the room.
- cyphar 1y agoAnd you need to opt-in to the global-and-off-by-default "don't send to unverified devices" setting, right? Or is it no longer the case that even if you verify a user, unverified devices of that users' account will still receive peer keys and messages? (The description of the global knob implies that this still is the case. I don't have time to test this at the moment.)