Are you all on OVH, then? Maybe my IP is the just the problem. Or do you all perhaps have older domains? Did you do any IP warming? I’d love to know. The openness of email is important.
(And fwiw, I’m not the same person as who implied you’d have to pay. In fact, I’ve never heard of that before)
Login interface in Tempus has no SSO option.
Yes, I know. You said that.
Since you’re dissapointed about that, I figured there would be another client that does have support for SSO. I was asking you which client that would be.
Right now, you can’t. Tuwunel has had migration from Synapse on the roadmap since forever (it’s issue #2 on gh)
So for the time being, if you’re on synapse, you’re stuck on synapse
Exactly!! This really needs to change.
Security is important, of course, but it’s not like vodozemac is that good anyway…
(Sorry about the length, I’m rather passionate about this. The second half can be ignored)
Essentially, the key to decrypt your old messages is tied to your session. On your (presumably) first session, you can get a recovery key, which is a long hexadecimal string, and a recovery passphrase which you can decide yourself.
If you start a new session (i.e., you log in on another client), for your opd messages to be visible on the new one and your new messages on the ols one, you need to “verify” the new session. There are three ways you can do this.
Alternatively, if you forgot your key and your passphrase and logged out on all the other sessions, you can reset your recovery key, creating a new one and making your old messages unreadable.
(The following are just my thoughts on this) The recovery key is a PITA because most non-technical people I know don’t use password managers. Even if they did, though, it’s not like any password manager (afaik) offers to save your recovery key. You need to manually put it in there, separate from your account password, and manually enter it when you’re connecting a new client.
The recovery passphrase somewhat mitigates this, as they could simply use their favourite “use it everywhere” password, but I don’t think I need to point out the problems with that.
The emoji thing is cute and works quite well, but somehow people still get confused and justifiably vaguely irritated that they have to do it at all.
You just can’t expect normal people to understand that these are important security measures, they just want to log in and be done.
That said, most people log in once on their phone, very maybe twice to also have it on their laptop and then never have to think about it again. That, however, is a problem in and of itself, because at some point they’ll get a new phone, chuck the old one, try to log in and realize they have no idea what their key is.
OpenSubsonic has an SSO standard? Which client+server do you use for that?
Cinny is also still a very good option! Especially if non-techy people are gonna be using it, as its UI is more stable (as in, changes less)
Honestly the only real problem that’s holding me back from using Matrix for everything is that it’s really inconvenient (for non technical people) to set up an additional device, as you have to verify it.
I’ve had to walk too many people through this.
So you want the client to save them instead?
What if they’re using a web client? Browser storage? Unencrypted or do they need to enter a pw every time they log in?
I’m not saying you’re wrong, but I think this would be very difficult to do correctly, especially in a manner that would work for people whose first question isn’t how much metadata the server has access to
Listen, I’m happy for you that your setup works, truly. I’m absolutely not trying to imply that it isn’t. It’s simply just not “fine all around”. It’s fine for you.
Thanks for making me realize that I literally don’t even need to be able to deliver to MS and I can just use my mailserver 😭
Lol no
Maybe if you’ve got a 10 year old domain that’s been actively sending legit email everyday or something, but my email from my server goes straight to spam on outlook. Literally everywhere else is fine.
// yes my dmarc, dkim and spf are fine. No I’m not on any blocklists. No my IP is not a residential IP lol. The domain and server just turned 1 year old last week :]
I would be very happy with a WhatsApp-esque ‘scan this QR code and be done’
There is a QR login feature in the Matrix spec, but far from every client/server supports it. IIRC it works in reverse, where the logged-in session shows the QR code. I’m actually in favor of this choice, as it means the user shouldn’t need to specify the homeserver address on the new client. I believe this doesn’t transfer your private key, though, meaning you would still have to enter your recovery key, recovery passphrase or go through the emoji thing. I could be wrong about any of this, it’s been a long time since I’ve last tried the QR login.
To me it feels like there’s a lot more friction than with WhatsApp or Signal, but to be frankly honest, I don’t really know how to solve the problem either.