Hookshot doesn't verify it's devices

[Twi1ightSparkle]

This generates red warning on all it's encrypted messages

And E2EE Hookshot will stop working entirely once MSC4153: Exclude non-cross-signed devices gets implemented.

[Half-Shot]

This requires https://github.com/element-hq/matrix-bot-sdk/, and the rust sdk bindings to support cross signing. This work isn't trivial, so I'll ask about it.

[szymczag]

Thanks, @Twi1ightSparkle, for bringing that up — I was just about to create a new issue for this.

Hello, @Half-Shot, is there any chance you could get this fixed in the near future?

[Half-Shot]

Hey hey, this is currently being looked at in element-hq/element-meta#2709

[szymczag]

@Half-Shot thanks! I can see that the work is in progress, so I'll keep my fingers crossed and wait patiently ;)

[Half-Shot]

I aim to not keep your fingers crossed for too long then :)

[szymczag]

I aim to not keep your fingers crossed for too long then :)

Hi @Half-Shot, any news? :)

[Half-Shot]

Hey, yes on this front. The Crypto team will be extending https://github.com/matrix-org/matrix-rust-sdk-crypto-nodejs/pulls to support verification, which then means hookshot will make use of it. element-hq/element-meta#2751 will also land so that at least manual verification will become possible.

I don't know the timelines for this work yet, but it must happen before element-hq/element-meta#2700 happens.

[andybalaam]

Workaround

element-hq/element-meta#2751 is now done, meaning that if you log in to EW as the bot's user and you have the ed25519 fingerprint ("security key") of the device the bot is using, you can manually tell EW to sign the device, making the
bot verified.

Instructions on how to do this (on the EW side) are at: element-hq/element-web#30094

I'm not sure how easy it is to get the fingerprint out of Hookshot. Hopefully @Half-Shot knows

[lephisto]

Does anyone know? I would really like to use Hookshot in e2e encrypted rooms :(