element-hq / element-hq/element-android

Recovery passphrase/key less than useless; only room key import works properly

Open
#7,434 1 comment 0 reactions 0 assignees View on GitHub
A-E2EE-Key-Backup O-Frequent S-Major T-Defect
Dominant language
Kotlin
Stars
3.7k
Forks
917
PR merge metrics
No merged PRs in 30d

Description

### Steps to reproduce

1. Have a recovery passphrase/key active. Ensure all things are being backed up properly in Security settings.
2. Export room e2ee keys.
3. Sign out of Element.
4. Sign in again.
5. Enter recovery key/pass when prompted.
6. App happily claims that my messages are now readable.
7. Open any room: "waiting for this message, may take a while" spam. In all encrypted rooms. For all messages. No exceptions.
8. Tried sending a few test messages back and forth with a contact. No dice. Pre-logout messages stay encrypted no matter what.
9. Import room e2ee keys.
10. Voila! All messages from the beginning of the universe are now readable!

### Outcome

#### What did you expect?

The recovery key/pass was supposed to be a safe haven for users to be able to decrypt their messages if they couldn't verify using an existing session. This means it is the only option for users logging out of their last session.

#### What happened instead?

It doesn't work. Room key exports are a MUST if you're planning to log out of your last session.

### Your phone model

_No response_

### Operating system version

_No response_

### Application version and app store

1.5.2

### Homeserver

fairydust.space

### Will you send logs?

No

### Are you willing to provide a PR?

No

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.