Starting with Element Web / Desktop 1.12.33, verifying your device is mandatory by default. After signing in on a new browser or desktop session, you will be asked to verify it before you can start chatting. The step can no longer be skipped. Sessions that already exist and are unverified continue working as is for the time being.
Safer conversations
When you log in for the first time, Element creates a digital ID for you. That digital ID is used to sign your legitimate devices. So when you log into a second device, you need your first device to sign the second one. This device verification signing proves that someone didn't just steal your credentials, and gives your new device the keys required to read your encrypted history.
All the important keys are also stored in an encrypted, safe vault tied to your account on your server. Your server admin can't see it: only your verified devices and your recovery key can unlock it. If you lose all your devices, your recovery key is the only thing that can unlock this vault.
Requiring device verification when you sign into a new session means that the new device is secure and fully onboarded. It's an important step towards excluding devices that have not been verified from your conversations for extra security.
How to verify a device
If your devices are already verified and your recovery key is set up, nothing changes for you. On your next sign-in, you'll verify the new session with another device or your recovery key, as usual.
If you haven't set this up yet, now is a good time:
- Check that your existing devices (mobile, web and desktop) are verified.
- Set up recovery, so you can verify new sessions even if you lose all your other devices.
Step-by-step instructions are in our user documentation.
For administrators
If your deployment needs more time, you can keep the previous behaviour by setting the option in your config.json:
{
"force_verification": false
}If you're using ESS (Community or Pro) to deploy Element Web, then you should apply this configuration as per ESS instructions in here, e.g.
elementWeb:
additional:
force-verification.json: |
{
"force_verification": false
}We recommend using this only as a temporary measure. Unverified devices will be excluded from encrypted conversations as the wider transition completes, so helping your users verify now avoids disruption later.
