It should be very obvious when E2EE is NOT enabled for a Direct Message

[ell1e]

Description:

I've only now just realized after years(!) of being an occasional rocket chat user, that despite my assumption that all direct messages used the E2EE encryption, none of them did. This seems like a sort of UI oversight, and I would suggest that if a user account has E2EE available with an end-to-end-encryption password set, that whenever that user looks at any direct message chat there should be some clear warning if that chat is currently not using that encryption.

Also, opening a new DM should probably automatically use E2EE, unless I explicitly opt out. However, that seems like a separate concern I guess.

Steps to reproduce:

1. Use Rocket Chat for a while with E2EE password set
2. Realize you're not actually using E2EE for direct messages even though you thought you were

Expected behavior:

There should be a big warning if an E2EE password is set but a direct one-to-one chat doesn't use it.

Actual behavior:

Sadly, there doesn't seem to be a good warning of any kind:

Server Setup Information:

• Version of Rocket.Chat Server: I don't know, some variant of "Rocket.Chat Community". I couldn't find any section in the preferences that shows the server version.
• License Type:
• Number of Users:
• Operating System:
• Deployment Method:
• Number of Running Instances:
• DB Replicaset Oplog:
• NodeJS Version:
• MongoDB Version:

Client Setup Information

• Desktop App or Browser Version: Librewolf 152.0.4-1
• Operating System: Linux x64

Additional context

Relevant logs:

[Ashutosh-1304]

Hi there! I would love to work on this issue
My approach would be to check the user's global E2EE preference state alongside the current DM room's encryption state, and conditionally render a UI warning banner/icon in the room header if E2EE is available but inactive

Could you please assign this to me?

[Gummikavalier]

The current default seems to be that the message is encrypted only if it has the green key icon at the DM top bar and in the message header after the user's name.

Particularly the green key at the top bar can mislead people if the messages are encrypted but attachments (files) are not.

There are good reasons why many instances do not run DM channels E2EE enabled by default; E2EE still has bugs particularly with encrypting files (completely broken in Firefox last time I tested that), rendering of messages failing completely in some situations, and completely losing search feature, which operates on the server side and thus cannot see into E2EE messages to index them.

In our own RC instances I've made sure that users are told that E2EE is not enabled by default on the Home-page of RC. I've added also some notes regarding E2EE's shortcomings. (Losing search functionality is usually the biggest issue for the users and they adapt not to use E2EE where not strictly neccessary.)