diff --git a/src/crypto/algorithms/megolm.js b/src/crypto/algorithms/megolm.js
index 8803d31d1..1b59bc166 100644
--- a/src/crypto/algorithms/megolm.js
+++ b/src/crypto/algorithms/megolm.js
@@ -473,8 +473,10 @@ MegolmEncryption.prototype._getDevicesInRoom = function(room) {
     // with them, which means that they will have announced any new devices via
     // an m.new_device.
     //
-    // XXX: what if the cache is stale, and the user left the room we had in common
-    // and then added new devices before joining this one? --Matthew
+    // XXX: what if the cache is stale, and the user left the room we had in
+    // common and then added new devices before joining this one? --Matthew
+    //
+    // yup, see https://github.com/vector-im/riot-web/issues/2305 --richvdh
     return this._crypto.downloadKeys(roomMembers, false).then(function(devices) {
         // remove any blocked devices
         for (const userId in devices) {
diff --git a/src/crypto/index.js b/src/crypto/index.js
index 822184c48..18a9d5c59 100644
--- a/src/crypto/index.js
+++ b/src/crypto/index.js
@@ -711,7 +711,7 @@ Crypto.prototype.setDeviceVerification = function(userId, deviceId, verified,
     }
 
     let knownStatus = dev.known;
-    if (known !== null) {
+    if (known !== null && known !== undefined) {
         knownStatus = known;
     }