element-hq / element-hq/element-android
Prioritising Recovery key over Recovery passphrase
- Dominant language
- Kotlin
- Stars
- 3.7k
- Forks
- 917
- PR merge metrics
- No merged PRs in 30d
Description
## After registration
Bootstrap the cross-signing in background during the registration flow. The operation will be invisible to the end user.
This means:
- [x] Create cross-signing keys (MSK, USK, SSK) and store them locally.
- [x] Upload their public parts to the HS. This requires auth but we have all credentials during this flow.
- [ ] Support bootstrap with SSO.
- [ ] TBD: Create proactively the key backup key and store it locally.
Doing it before it is actually needed will allow to share it (via secret sharing) to new user's devices before the user creates a recovery key. This is to avoid unsync behavior for this key.
## For regular login (or app update)
- [ ] If the user has not set up cross-signing yet, we need to ask them to do so.
The plan is to use a banner and security settings. This is will require to request account password (that would be great to think how to manage SSO as well).
Design: https://www.figma.com/file/wwqBo5oAFfk8XKmtd2YaIs/Cross-signing?node-id=5050%3A31796.
## Ref
Design: https://github.com/matrix-org/riot-artwork/issues/36
Contributor guide
Assessment
This issue has not been assessed yet.