Matrix users doesn't know how to use matrix securely

[Kreyren]

Context: I use matrix with E2EE and decrypting only to verified sessions that i verify only when i am certain that i am talking with the person that i expect to talk.

The issue is that there are too many people like:

That breaks this workflow which makes me uncomfortable thinking that someone is reading my messages with them, because they forgot to log-off or something..

Proposal

1. Add huge red message at the top when the user exceeds set amount of sessions for appropriate clients
2. Add MSC that adds temporary sessions that are destroyed after X amount of time or other trigger (usually people log-in in a temporary session e.g. in a school computer and leave later)

[richvdh]

I think this is essentially a duplicate of #8263.

[reivilibre]

It's hard to say you're wrong; in most cases a user with 148 devices probably doesn't care about most of them anymore.

Add huge red message at the top when the user exceeds set amount of sessions for appropriate clients

I think Element Web (at least) already suggests the user review their logins with a button that will take them to their list of devices with a way to remove old ones.
However, it probably gets dismissed instinctively 90% of the time because it's a bit of a nag — I'm not sure how this could be improved myself.

Add MSC that adds temporary sessions that are destroyed after X amount of time or other trigger (usually people log-in in a temporary session e.g. in a school computer and leave later)

This idea might have some merit; it would also be fairly easy to implement in the grand scheme of things (at least server side; but on the client it's not hard to imagine a drop-down box at the login screen where you can choose how long your session is, for example).
It may be worth having a look around at existing MSCs (in case someone already thought about this) or proposing one!

---

I think this issue may be more suited to e.g. Element Web's repository; I think this issue is more concerned about making things intuitive for the user; Synapse can't really improve anything here (until an MSC exists, at least).

As a side note, if you're concerned about your messages being sent to someone else who hasn't taken the time to prune their device list, I believe you can usually configure your client to only send to specific devices you trust, or you can (I think) also mark some devices as untrusted (not sure how that will interact with key sharing on their side though).