Cross-signing: Phase I

[nadonomy]

Overview

This is a parent issue to track outstanding front-end development & design issues that relate to cross-signing.

Phase I of cross-signing is being defined as an MVP for cross-signing being enabled by default, where end users can use cross-signing and establish a reasonable mental model of how encryption, trust & device verification works.

Phase II onwards will include polish and other nice to haves.

(Internal) Zeplin link, with image previews available in child issues below: https://zpl.io/2EW6lpD

---

Issues & outstanding

Note: I'm using this issue to track the implementation details that we arrive at within the scope of Phase I of cross-signing, as the implementation may differ to other phases or milestones that relate to e2e by default.

User profiles: #10606

• Confirm if (+) is now redundant, instead just have [Start a DM] or [View DM] button
• Confirm (with whoevers implementing) how much of the modality to bite off during Phase I

Inbound verification: #10607

• Confirm we're landing Immutable DM's, if so track within Phase I of cross-signing?

Outbound verification: #10608

• Do we need a ‘waiting for other user to accept verification’ right panel state?
• Clarify what happens if the user is using a client that doesn’t support cross-signing
• Confirm implications of not showing a device list until trusted
• Confirm we’re aligned on using one device/session agnostic [Verify] button, where verification requests can be accepted by any device/session

Verify new devices at sign in: #10609

• Approve from existing trusted devices only?

Settings: #10610

• Confirm what to implement within the scope of cross-signing Phase I
• Anything missing? E.g. device id’s, expose modally?

Iconography: #10611

• Confirm how much e2e decoration to implement within the scope of cross-signing Phase I

[AmandineLP]

Few questions, it might be better to adress your open points on a quick call ?

On User profiles: #10606

• Note they're different on these screens and on the ones in Cross-signing: Outbound verification #10608
• how to send verif request?
• what happens when clicking on "learn more"?
  

On inbound verif #10607

• what happens when clicking on "learn more"?
  

On Sign-in #10609

• I think "New sign in detested" can work, but I would probably avoid talking about "sign-in" in the following messages, e.g. in "Confirm the emojis below are displyed on your new sign-in": it feels a bit clunky. I deally I guess we would say "on the new device with which you signed in" but it's long, wouldn't "on your new device" be better? Or are you worried that if they logged out from a device and are relogging in they'll be confused because it's the same physical device?
• Do we want to propose the user to edit their device's name at the same time?

On Settings #10610

• how can we edit our device's name?

On Iconography: #10611

• what is an encrypted and trusted (or encrypted and trusted but with a warning) room?