Device dehydration: users should be able to see their own dehydrated device(s)

[richvdh]

Currently, there is no way [1] for a user to see if there is an active dehydrated device on their account. Such devices are hidden from the "Sessions" tab.

Hiding this information is problematic from the security point of view: users should be able to find out whether clients are making dehydrated devices behind their backs.

[1]: Other than in the "Security & Privacy" settings tab, which will be removed by #29088.

Update: this is now visible but in the wrong place. To do:

• Move it to the Encryption Settings tab
• Change the wording to match the designs
• Make it visible even if there is no dehydrated device (as per designs)

[richvdh]

There was previously a suggestion that it would be adequate to say "You have an offline device enabled" somewhere, provided having multiple dehydrated devices was treated as an error case (so that none of the dehydrated devices receive keys). It looks like the first part happened previously (but is being removed by #29088), though the second did not.

[dkasak]

There was previously a suggestion that it would be adequate to say "You have an offline device enabled" somewhere

Relatively prominently saying this, mind you, not in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying 'Beware of the Leopard' or anything like that.

The concession was that dehydrated (offline) devices needn't be shown as normal devices, to avoid confusing users who would be wondering why the list of devices now includes something which isn't a computer or electronic gadget of theirs. But it should still be readily apparent that the feature is enabled to users that actively go seeking out their list of devices.

[mxandreas]

@richvdh Did you check that #29088 is actually removing the offline device enabled paragraph? The intention was to remove only the parts that have been migrated to the Settings > Encryption so there would not be any duplicate entry points. Thus, if feasible, I would leave this paragraph to stay.

@americanrefugee Can you please also make sure the this offline device enabled paragraph exists in the new designs? I think it can be somewhere under the Privacy section. One thing I suggest for the sake of clarity is not to entirely hide/show paragraph when the offline device is enabled/disabled but always show it and then use "checkbox" (disabled) or something like to indicate if it is disabled/enabled.

[americanrefugee]

@mxandreas Here is my proposal. I added a comment to further explain my decisions. WDYT?

[richvdh]

@richvdh Did you check that #29088 is actually removing the offline device enabled paragraph? The intention was to remove only the parts that have been migrated to the Settings > Encryption so there would not be any duplicate entry points. Thus, if feasible, I would leave this paragraph to stay.

As the PR currently stands, yes this is being removed. It's part of the "Encryption" section which is being removed from that tab in favour of the "Encryption" tab.

We can re-introduce it, of course, but we'll need a different heading.

[mxandreas]

It's part of the "Encryption" section which is being removed from that tab in favour of the "Encryption" tab.

This is not what the specification (or the PR's title) says, the spec says:

Remove Security & Privacy > Secure Backup section.
Remove Security & Privacy > Cross-signing section.
Remove Security & Privacy > Cryptography section.

Note that there is also the Message search under Encryption for which there is no alternative; and I did not think we get rid of this as part of this.

We can re-introduce it, of course, but we'll need a different heading.

I am fine keeping the Encryption header (not ideal) because we have new designs anyway that we need to apply.

[richvdh]

It's part of the "Encryption" section which is being removed from that tab in favour of the "Encryption" tab.

This is not what the specification (or the PR's title) says, the spec says:

Sorry, you're right, I misspoke.

The "Encryption" section is staying; the "Secure Backup", "Cross-signing", and "Cryptography" panels are being removed from within it; "Message search" (aka eventIndex) is staying: https://github.com/element-hq/element-web/pull/29088/files#diff-2626dd59ec05573785894010f772c9f1cd9f70c91c9e436ebb605d4f7ab255bfR327-R333

Nevertheless, the "Offline device" section is part of "Secure Backup", so is currently targeted for removal.

If we want to keep "Offline device" as well as "Message search", I guess we'll need to re-style the "Offline device enabled" heading to have the same weight as "Message search"?

[mxandreas]

If we want to keep "Offline device" as well as "Message search", I guess we'll need to re-style the "Offline device enabled" heading to have the same weight as "Message search"?

Normally, that would be the case. However, given we want to re-design this entire tab, I am OK keeping the "Offline device enabled" as-is directly under the large Encryption heading.

[americanrefugee]

Here is a design proposal. Just discussed this with Andreas and have added a comment in Figma.

[mxandreas]

@florianduros or @dbkr When you get to merging the #29088 - can you please retain the "offline device enabled" part under the Encryption heading of the Security & Privacy tab. We're currently in the process of finding the proper place/UI for this but given that no one currently has time to implement the new/proper UI immediately, we'd keep the current one so that all is good from a security perspective. Let me know if there are any follow-up questions.