matrix-encrypted-webhooks icon indicating copy to clipboard operation
matrix-encrypted-webhooks copied to clipboard

Verify matrix webhook session

Open enter286 opened this issue 1 year ago • 4 comments

Is it possible to verify the matrix session from this webhook? As all messages sent from the webhook currently have a warning that the session isn't verified.

image

I tried verifying from another session in my browser, but that does send a message to this client, but I don't see a way to receive it?

enter286 avatar Nov 07 '24 07:11 enter286

Tried to manually enter the device_id and access_token in the credentials.json as described here: https://github.com/immanuelfodor/matrix-encrypted-webhooks/issues/1#issuecomment-900852819

The error message under the red exclamation mark changed from: Encrypted by a device not verified by its owner to Encrypted by an unknown or deleted device.

enter286 avatar Nov 07 '24 08:11 enter286

It's possible to do manual or emoji verification with the Nio library that this project uses, but it's not (yet) implemented in the E2EEClient.py, so you can't do it today. The linked comment is about another topic with SSO login, it's unrelated to yours.

Why I haven't implemented verification?

  • I'm the only user
  • The whole thing runs in a private network with no external access
  • Only Element is reluctant to complain about trust, better clients, such as SchildiChat don't complain
  • Even larger projects, such as Mautrix bridges don't implement it, so if it seems "good enough" to them, then it's good enough to me :grinning:

But I'm happy to accept a PR if you (or anybody else) add verification to the project! :pray:

immanuelfodor avatar Nov 07 '24 08:11 immanuelfodor

For some reason I had verification working without issues on a previous server installation. Just moved it to a new server this week and for some reason can't get it to appear as verified anymore.

image

Really appreciate your response. Just wanted to make sure there wasn't an easy fix I'm overlooking.

enter286 avatar Nov 07 '24 09:11 enter286

Yeah, nothing to worry about, the bot messages are still end-to-end encrypted, it's just a "cosmetic annoyance" by the Element clients.

immanuelfodor avatar Nov 07 '24 09:11 immanuelfodor