Element-web: "Review session" flow should give option to kick out malicious devices
Currently it just lets you verify them, but to actually remove a device you're not expecting, you have to go spelunking in settings.
ara4n
All 3 comments
To be improved post-release.
jryans
on 16 Apr 2020
One additional improvement would be an option to bulk delete devices that are unverified and/or have not been active for some time. E.g. see #14218 for a user that has accumulated 400 unverified sessions (by clearing browser cookies without logging out, which is not the best approach, but it does apparently happen).
matthijskooijman
on 6 Jul 2020
Also note that this is issue is particularly relevant since there is currently no way to distinguish verified from unverified sessions in the "Security & Privacy" settings (where you can delete sessions), and no way to delete sessions from the user profile page (where you can see which ones are verified), so cleaning up and deleting all unverified sessions is currently quite tricky (requiring manually comparing identifiers between these screens, I think).
Edit: #13596 is related, and suggests showing verification status in the settings list.
matthijskooijman
on 6 Jul 2020
Related issues
turt2live
路
3Comments
lukebarnard1
路
3Comments
MurzNN
路
3Comments
ara4n
路
3Comments
t3chguy
路
3Comments
Most helpful comment
Also note that this is issue is particularly relevant since there is currently no way to distinguish verified from unverified sessions in the "Security & Privacy" settings (where you can delete sessions), and no way to delete sessions from the user profile page (where you can see which ones are verified), so cleaning up and deleting all unverified sessions is currently quite tricky (requiring manually comparing identifiers between these screens, I think).
Edit: #13596 is related, and suggests showing verification status in the settings list.