2026-10-28T10:20:25Z https://nostr.now lavacat https://nostr.now/npub1wa02pkql6akc3jpjqpnvc0j27u586hjh9xaz8u5nxvyceal6zseqy63vkq https://mk.donotclickthis.link/files/c37bbee8-e50c-4335-a3e9-d252b05b2fd8 https://mk.donotclickthis.link/files/c37bbee8-e50c-4335-a3e9-d252b05b2fd8 https://nostr.now/nevent1qqs057wmml5u4j8aj7wf4rfmhe563nhgycujemm55kr93tw5eezrttqzypm4agxcrltkmzxgxgqxdnp7ftmjsl272u5m5gljjvesnr8hlg2ry96h953 Element apps for Android and iOS have some suspicious mechanism to hide device verification dialogs from users on some homeservers (at moment of writing this, dialogs are hidden only for one homeserver though) ([Android client commit](<a href="https://github.com/element-hq/element-android/commit/049f10ffa027e914a1e3ff99aa2a61f85a442c54">https://github.com/element-hq/element-android/commit/049f10ffa027e914a1e3ff99aa2a61f85a442c54</a>), [iOS client commit](<a href="https://github.com/element-hq/element-ios/commit/e977a9a0def8ee1f62a366335fe8c75f1d4d3f5c">https://github.com/element-hq/element-ios/commit/e977a9a0def8ee1f62a366335fe8c75f1d4d3f5c</a>)), that thing was added ~2 months ago.. this looks like backdoor-like stuff to me, especially because homeserver domains are hashed<br/><br/>What the heck, <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1tccury3pwf0fcrn7cva564hk886gl5sc8tt9kky00wh8mzuevmnqxt4342" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Element</span> (<span class="italic">npub1tcc…4342</span>)</a></span>? :neofox_what: 2026-08-09T20:20:16Z