LoginSign Up
← Back to all sparks
E

Element

COMMS
Velocity5.0

Secure Matrix-based team messaging and collaboration client

element.io ↗

Element 1.12.33 ships: simpler recovery keys, mandatory verification, no libolm migration.

encryptionrecovery-keysdevice-verificationmodule-apisecurity
◆Current state
Element Web is in a sustained crypto-UX cleanup. The last three release lines made device verification mandatory by default, removed guest-token and NEB-link attack surface, and 1.12.33 now trims the recovery-key setup flow and prompts users about their key on logout. Alongside that, the legacy customisation API is gone and the Module API is growing X.509 identity hooks.
◆Where it's heading
The direction is consistent: fewer optional security steps, more enforced ones, and a smaller legacy surface. Dropping libolm session migration means the Rust crypto stack is now the only path, and the X.509 work signals identity verification built for managed deployments.
◆Prediction
Expect the next release candidates to keep polishing recovery and verification dialogs, with further X.509 verification pieces landing in the Module API.

◆Recent moves

  1. 1d ago

    Element 1.12.33 ships simpler recovery keys, ends libolm migration

    The final 1.12.33 ships the RC unchanged: a shorter recovery-key setup, a logout prompt about the recovery key, unskippable device verification and the end of libolm session migration. It closes another step in Element's move to enforced, Rust-only encryption.

    View source ↗
  2. 10d ago

    1.12.33 RC simplifies recovery keys, drops libolm migration

    The 1.12.33 release candidate removes the intro screen from recovery-key creation, adds a logout prompt about the key, and drops libolm session migration. It continues the crypto UX cleanup started in 1.12.31.

    View source ↗
  3. 13d ago

    Element 1.12.32 removes guest tokens and NEB links to fix 2 advisories

    A security release that removes NEB starter links and guest access tokens to close two advisories. Cutting legacy entry points rather than patching them matches the release train's shrinking-surface pattern.

    View source ↗
  4. 16d ago

    Element 1.12.31 makes device verification mandatory by default

    1.12.31 makes device verification mandatory by default and adds Markdown and PDF viewers in the right panel. The verification change is the one that shapes the rest of the month's releases.

    View source ↗
  5. 21d ago

    1.12.31 second release candidate, feature list unchanged

    A second release candidate with an unchanged feature list; it exists to stabilise 1.12.31 before release.

    View source ↗
  6. 23d ago

    RC adds PDF/Markdown viewers, mandatory device verification

    The first 1.12.31 candidate introduced the mandatory-verification default and the new attachment viewers that later shipped in the final release.

    View source ↗