E2E stability and usability.

[lampholder]

Project: https://github.com/vector-im/riot-web/projects/5

Push to improve E2E stability and usability:

• Changing password not destroy your E2E history changing password should not log out all your devices (and destroy your e2e history) element-web#2671
• E2E VoIP calls don't work desktop<->mobile e2e voip calls don't work web<->ios & android element-web#2669
• Olm race conditions across multiple tabs Olm is prone to race conditions across multiple tabs element-web#2325
• UISI "Unable to decrypt: The sender's device has not sent us the keys for this message." (The UISI bug) element-web#2996

[abread]

I have a suggestion that I didn't see anywhere. We, techies, handle it fine, but regular users may feel intimidated by all the "Verify Device" prompts. I propose that, by default, the process of adding a new device simply means an existing one has to acknowledge its existence via a prompt (and the other ones are just automatically introduced to it no questions asked). Also, they wouldn't be bothered with verifying other people's devices manually.

For the more privacy conscious, stricter opt-in options would be available to:

• Require the user to manually verify their own devices in every other device, manually preventing cross talk.
• Require the user to manually verify other people's devices.
• (maybe) Require everyone to follow your policy (admin-only of course).
  These options would be available both per room and as a "Please do this in every room by default".

Regular users will see significantly better usability for E2E encryption without worrying about it. Those that want more, can get more, where they want more.

(Also, sorry if this isn't the right place to discuss this. At the time of writing it seemed the most fitting.)