element-hq / element-hq/element-android
[UX] Be able to export keys and E2EE data from a logged-out session
- Dominant language
- Kotlin
- Stars
- 3.7k
- Forks
- 917
- Avg merge
- 8d 20h
- Merged PRs (30d)
- 1
Description
Currently, whenever a device gets logged out (on android), you're able to log back in *without* re-trusting the device, this hints that the E2EE data is stored on the database of the android app.
The feature i'm requesting here is the ability to be able to export that (somehow) while the user is locked out, or somehow not able to access their account, this "wraps" the hot potato that the device was carrying, and allows them to either a. transfer it to a new device, or b. back it up.
The security implications of this should be considered, even the security implications of having someone have their E2EE keys still (forensically) available on the device after they've been logged out by error or intentionally.
This last problem can/will be solved with Dehydrated Devices, and i think the intention to not wipe this data upon logout is a practical solution to allow someone to retain their E2EE history, but it'd be useful to be able to export that (somehow).
Contributor guide
Assessment
This issue has not been assessed yet.