1. Click reset password 2. You enter your email and new password (already here!) 3. A password reset request has been received for your Matrix account. If this was you, please click the link below to confirm resetting your password: [link] If this was not you, do not click the link above and instead contact your server administrator. Thank you. 4. Text page with the sentence "You have requested to reset your Matrix account password" but a button saying "Confirm changing my password" 5. Button clicked, password is set to the one entered in step 2.
This just absolutely is waiting for abuse. Every other site asks you to enter the new password after you have clicked the link. Here it's before you have clicked and there is no option to see or confirm the password entered initially. There is no indication that that is what's happening. In addition the word 'reset' is confused with 'change'.
Super easy for anyone - even the most techie user - to be fooled by this workflow. Someone else initiates the request and enters a new password, grandma gets the reset link and clicks it, password is changed and the other party can login and change also the email.
I would have to spend hours getting my family signed up for this thing.
> Cannot reach homeserver > Ensure you have a stable internet connection, or get in touch with the server admin
wise prediction of yours ;)
next you're going to tell me grandma should just use IRC instead.
I host my web, my email, my XMPP, my TURN/STUN, etc, so I gave Matrix a try. In short: it's horrible. It's insanely resource hungry, both synapse and dendrite, plus dendrite is so not finished it hurts.
Stick to XMPP until Matrix is in an actually usable shape when one doesn't need a small power reactor to run it.
About an hour ago.
This is the level of technical ability that you need to be targeting.
Re "you said it was called Matrix": fair, but I wouldn't send people to "matrix" / the protocol for any system with multiple implementations. I'd send them a link to one of the user-friendly apps (i.e. Element). Similarly, you wouldn't tell someone to join XMPP, you'd send them to the Google Hangouts or MSN Messenger or Playstation apps.
This is a friction-filled experience for someone coming from WhatsApp
Also, search still doesn't work in encrypted rooms.
Compared to installing the Signal app and verifying your phone number over SMS, the difference is quite remarkable. Signal has had smooth and frictionless onboarding as part of the design.
But also, comparing Matrix to Signal is a bit like comparing apples to oranges IMO.
The real apples to oranges comparison is you thinking that this wiki page is somehow comparable to registering a signal account.