New session manager beta wants me to verify session that doesn't support it

[MadLittleMods]

Steps to reproduce

Found while compiling: #23709

With the new session manager beta, it wants me to verify this session:

But according to the old session management, that session doesn't even support verification. I don't know what's special or different about that other session. Maybe the session was created from some client API usage since it's the archiver used with the Matrix public archive, not sure why it would say "Chrome, Windows" then though.

In any case, we seem to be able to detect the difference in the old session manager which is lost in the new one.

Outcome

What did you expect?

Only verifiable sessions are suggested to verify

What happened instead?

All unverified sessions are shown

Operating system

Windows 10

Browser information

Chrome Version 107.0.5304.88

URL for webapp

https://develop.element.io/

Application version

Element version: 577a6b7-react-be5a8ca3b9c7-js-52932f59ab64 Olm version: 3.2.12

Homeserver

matrix.org

Will you send logs?

No

[Johennes]

Looks like this category is chosen for devices that throw when trying to access the cross-signing info: https://github.com/matrix-org/matrix-react-sdk/blob/7d0af1dca46b75aec23f7aa1a4d2c80746f5e56e/src/components/views/settings/DevicesPanel.tsx#L134

It's unclear to me what exactly the conditions are under which this happens.

@MadLittleMods how could we create a session like this ourselves on a test account to investigate and verify this across platforms?

[MadLittleMods]

@Johennes I have no idea about reproduction steps to create that type of session. But perhaps we can export whatever data I have there. Any JavaScript snippet handy to extract it?

[alfogrillo]

I don't know if it's related but on iOS I'm often finding new sessions not able to get the status of other sessions.
This happen because our code expects the device to be in the state StateCanCrossSign to get other devices' states while it often happens to be in the state StateCrossSigningExists.
As result all the other sessions are in the unknown state.
Does this looks correct @Johennes?

[Johennes]

Hm, I think this one is different and means that your session can do cross signing but hasn't yet been verified so you cannot see the verification status of other sessions until that is done.

[Johennes]

@Johennes I have no idea about reproduction steps to create that type of session. But perhaps we can export whatever data I have there. Any JavaScript snippet handy to extract it?

@kerryarchibald once you're back, could you chime in an see how we might be able to reproduce this?

[alfogrillo]

Hm, I think this one is different and means that your session can do cross signing but hasn't yet been verified so you cannot see the verification status of other sessions until that is done.

@Johennes the web looks to behave differently, they can see other sessions' states even if the current session isn't verified. 🤔

What is Android doing @mnaturel?

[Johennes]

Yes we discovered this before. Android should behave similar to iOS but web doesn't as you say. It's a known platform difference that should be cleared up.

[mnaturel]

Yes we discovered this before. Android should behave similar to iOS but web doesn't as you say. It's a known platform difference that should be cleared up.

I confirm Android behavior is aligned on iOS behavior right now. But I don't know the status of this current issue on mobile as we should first find a way to be in the same conditions if it is possible.

[alfogrillo]

To be honest it looks like a bug to me on the mobile unless there are specific reasons why we would prefer this behavior.

[Johennes]

@onurays managed to reproduce the issue on an older session he happened to have in his account and it looks like the device didn't upload crypto keys (and hence doesn't support encryption / cannot be verified).

[Johennes]

Confirmed the way to reproduce this is to simply login through the API via curl

curl -d '{ "type": "m.login.password", "identifier": { "type": "m.id.user", "user": "..." }, "password": "..." }' -H "Content-Type: application/json" -X POST https://matrix-client.matrix.org/_matrix/client/v3/login

Afterwards I'm getting the session in the "Devices without encryption support" on Element Web.