In an encrypted room, every message is locked with keys that live only on the devices that were in the room at the time. If you log in on a new device (or your browser storage gets wiped), that device has none of those keys, so old encrypted messages show as "Unable to decrypt". Key backup is Matrix's fix: each device uploads an encrypted copy of its keys to your homeserver, locked with a recovery key/passphrase only you know. A new device enters the recovery key once and can read all history.
Lotus already has the backup machinery (Settings → Account: BackupRestore.tsx, useKeyBackup.ts, cross-signing, SSSS). What it does not have (verified 2026-09-17) is any nudge: if a user never set backup up, or this device isn't connected to the existing backup, nothing tells them until the day they lose history. The KE-1..4 cluster in LOTUS_TODO is what "no backup + a wiped crypto store" looks like from the user's side.
Proposal
A dismissible banner (sidebar bottom or room-list top, like the unverified-device warning) in exactly two states:
No backup exists → "Back up your encryption keys" → opens the existing setup flow.
Backup exists but this device isn't using it (getActiveSessionBackupVersion() null while getKeyBackupInfo() non-null) → "Connect this device to your key backup" → opens the existing restore flow.
Snooze for 7 days; never shown once healthy; no new server calls beyond what the settings page already makes.
Decision needed from you
Do you want this at all (some users find security nags annoying)?
Banner vs. a red dot on the Settings avatar only?
Should admins be able to see who has no backup? (Answer: no — that's server-side data we can't and shouldn't read. Just confirming scope.)
**For Jared — what this is, in plain terms.**
In an encrypted room, every message is locked with keys that live only on the devices that were in the room at the time. If you log in on a new device (or your browser storage gets wiped), that device has none of those keys, so old encrypted messages show as *"Unable to decrypt"*. **Key backup** is Matrix's fix: each device uploads an encrypted copy of its keys to your homeserver, locked with a recovery key/passphrase only you know. A new device enters the recovery key once and can read all history.
Lotus already has the backup machinery (Settings → Account: `BackupRestore.tsx`, `useKeyBackup.ts`, cross-signing, SSSS). What it does **not** have (verified 2026-09-17) is any *nudge*: if a user never set backup up, or this device isn't connected to the existing backup, nothing tells them until the day they lose history. The KE-1..4 cluster in LOTUS_TODO is what "no backup + a wiped crypto store" looks like from the user's side.
### Proposal
- A dismissible banner (sidebar bottom or room-list top, like the unverified-device warning) in exactly two states:
1. **No backup exists** → "Back up your encryption keys" → opens the existing setup flow.
2. **Backup exists but this device isn't using it** (`getActiveSessionBackupVersion()` null while `getKeyBackupInfo()` non-null) → "Connect this device to your key backup" → opens the existing restore flow.
- Snooze for 7 days; never shown once healthy; no new server calls beyond what the settings page already makes.
### Decision needed from you
- Do you want this at all (some users find security nags annoying)?
- Banner vs. a red dot on the Settings avatar only?
- Should admins be able to see who has no backup? (Answer: no — that's server-side data we can't and shouldn't read. Just confirming scope.)
jared
added this to the Features 2026-Q4 milestone 2026-09-17 13:27:07 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
For Jared — what this is, in plain terms.
In an encrypted room, every message is locked with keys that live only on the devices that were in the room at the time. If you log in on a new device (or your browser storage gets wiped), that device has none of those keys, so old encrypted messages show as "Unable to decrypt". Key backup is Matrix's fix: each device uploads an encrypted copy of its keys to your homeserver, locked with a recovery key/passphrase only you know. A new device enters the recovery key once and can read all history.
Lotus already has the backup machinery (Settings → Account:
BackupRestore.tsx,useKeyBackup.ts, cross-signing, SSSS). What it does not have (verified 2026-09-17) is any nudge: if a user never set backup up, or this device isn't connected to the existing backup, nothing tells them until the day they lose history. The KE-1..4 cluster in LOTUS_TODO is what "no backup + a wiped crypto store" looks like from the user's side.Proposal
getActiveSessionBackupVersion()null whilegetKeyBackupInfo()non-null) → "Connect this device to your key backup" → opens the existing restore flow.Decision needed from you