Element-web: "System Alerts" invitation looks like a phishing attempt

[cdetrio]

The "System Alerts invited you" dialogue box looks potentially malicious, as though it was a phishing attempt from a spam attacker.

[turt2live]

Related: https://github.com/vector-im/riot-web/issues/6796

[olof]

Could you clarify: was this not a phishing attempt? And if not, where can I find more info? Thanks... :)

[ara4n]

it's not phishing; sorry for confusion. https://twitter.com/matrixdotorg/status/999991655557140481

[ara4n]

also: https://matrix.org/blog/2018/05/25/gdpr-on-matrix-org/

[lampholder]

https://github.com/vector-im/riot-web/issues/6796 has a proposed fix.

Leaving this here for now for anyone who comes to github looking for information about System Alerts.

[ara4n]

One thing that could also help here is to reduce the number of links to just the one which needs to be clicked - currently the explosion of URL previews and the markdown'ed link make it very hard to see what you should be reading and click one, especially given the main one is hidden as a MD link rather than a standalone URL.

[turt2live]

I'm "blocking" this on a solution to https://github.com/vector-im/riot-web/issues/6796 because I have no other way to show that there's a link between two issues while keeping them both open.

[turt2live]

Discord seems to handle this pretty well:

• No invite, it just joins.
• No way to leave the DM
• It's a DM with the service
• The DM itself is annotated twice to indicate what it is (badge and subtext, neither of which normal DMs get)
• The composer is replaced entirely with a banner explaining what is going on, with a button to find out more
• When you receive a message, it puts up a dedicated dialog to bring you there
• The room cannot be muted or have its notification level changed

Edit: The link actually has the dialog mentioned above - https://support.discord.com/hc/en-us/articles/360036118732