The passive 'verify this login' modal at login is very confusing

[ara4n]

Rather than passively saying 'verify this login from another device', we should give the user an explicit button to press to select to verify based on another device, as opposed to entering the recovery passphrase/key. Psychologically I think this will help the user realise they need to do something to verify the new login.

Relatedly, pressing the button should re-trigger verif prompts on other devices by sending a new verif request out in case they were cancelled (this is #13186 though)

[ghost]

I think I had a related problem.

I signed up for matrix.org/Element some weeks ago. Today I wanted to sign in again and got the "verify this login with another device" popup on the web app, but I didn't have any other devices logged in that I could use. I never saved a Security Key, and was never prompted to enter it anyway. Someone on the Element chat told me I should try to reset the "Cross-signing" setting, but I never had it set up in the first place. It turned out that clicking the "Setup" button for this setting fixed the whole issue.

I think it was especially hard for me to find this setting, because the popup is called "login/session verification" and the setting is called "cross-signing" so I didn't make the connection that they are related.

Overall it was a confusing user experience and it makes it hard for me to recommend the service to my friends on Discord.

[Penguin-Guru]

I was also very confused by this. I didn't know why it appeared and, due to similar prompts from other applications, I thought my log-in attempt had failed (the red "skip" button looked like a cancel button to me). I did not receive any email to authenticate the log-in attempt and there was no mention of how I should authenticate. Very strange. Fortunately, someone told me I could just skip it and proceed, but then I was still unable to figure out how to authenticate myself later. I only figured it out after my computer crashed and I restarted Element, at which point a pop-up appeared offering to let me authenticate again.