That is only the case when you have verified your friends keys (by qr code or emoji string).
When one of your friends account is hijacked and has someone snooping on messages, you'd want to know that.
Though I see it might be confusing at first for users to understand that they have to sign their devices. Currently, you have to login with a username/password and afterwards (optionaly) get one of your other devices to sign your new device. Which the UI does clearly ask you to do though.
I'm using Element very sparsely, but keep getting annoyed by it. I did not care to touch any settings. I have a persistent tab in my browser and it keeps having the notification dot for silly reasons:
- My connection flaked out (duh, I closed the laptop lid).
- Connection for one of my contacts flaked out (?!).
- Something in the signatures changed.
I get how any of that might be a sign of compromise. But I really don't care, I don't use this for anything sensitive. And with only about 20% of notifications being about an actual message, I've developed a blindness towards it.
Edit: having written that, I've noticed it is not doing this right now. Come think of it, it might have stopped a while ago and I simply didn't notice (c.f. developed blindness).
No, no, no. I have been toying my own Matrix instance and I registered 2 users that I played with, exchanging pictures and messages. There were some glitches in the UI that insiste on flagging some sessions as insecure even though I verified every session.
Sometimes it got resolved all on its own, sometimes it stayed like that. No biggie in the end but you can find some bug reports like that on github. Most probably it's getting worked out or was but it definitely happened.
