element-hq / element-hq/element-meta
[Story] ER-233: Manually enter a recovery key (passphrase)
- Dominant language
- No language data
- Stars
- 112
- Forks
- 26
- Avg merge
- 6h 6m
- Merged PRs (30d)
- 4
Description
### Description
**Background**
In some environments it is challenging to store a generated recovery key because users are not used to using password managers, and/or the organization is discouraging or even banning the use of password managers. Thus, as a mitigation, users can choose the recovery key themselves which they can remember. Of course, what the user chooses is not used directly for encryption - the encryption key will be derived from this. Note that the primary downsides of this approach are:
* Users not choosing a string that is not strong enough.
* Users confusing it with their account password.
* Users overwhelmed with choices when both generated recovery key and manually entered one are available.
These concerns above are partially mitigated in the new designs below.
**Solution**
* The option to manually enter the recovery key (passphrase) is not available by default. It needs to be configured in the ESS to be active by setting a minimum length for the passphrase. Configuration is done via Element "well-known" see https://docs.element.io/latest/element-server-suite-pro/administration/user-provided-recovery-key/
* Activating this will deactivate the generated key - only one of them is available at a time.
* The only criteria for the entered passphrase is the length, others (e.g. must contain certain characters) will be added later if needed.
* Instead of requiring certain symbols, etc. we provide the user with the strength of the passphrase, but that is for information only (e.g. we would not block the user if the passphrase is weak).
* Designs: [Web](https://www.figma.com/design/hDUT4q0pynhkbmB5s56GN8/ER-162--Recovery-Key-Usability---Management?node-id=554-47936&t=0qVkzgWUnr0RIVRf-4) | [iOS](https://www.figma.com/design/hDUT4q0pynhkbmB5s56GN8/ER-162--Recovery-Key-Usability---Management?node-id=557-75848&t=0qVkzgWUnr0RIVRf-4) | [Android](https://www.figma.com/design/hDUT4q0pynhkbmB5s56GN8/ER-162--Recovery-Key-Usability---Management?node-id=557-77233&t=0qVkzgWUnr0RIVRf-4)
# Acceptance criteria
- TBD
# Leads
* Tech:
* Design: @americanrefugee
### Time sheeting
?
# Documentation
-
# Dependencies
- None
# Out of scope
- Nothing
# Open questions
- [ ] Is there an option to have a meaningful passphrase strength indication? E.g. is there library that we can use that does that
# Subtasks
### Android
-
### iOS
-
### Rust
-
### Other
- https://github.com/element-hq/element-docs/issues/275
## Sign-offs
- [ ] Android
- [ ] iOS
Contributor guide
No contributing guide indexed for this repository
Research direction
No implementation files, tests, or entry points are named. Start by reviewing the linked Web, iOS, and Android designs and the Element well-known configuration documentation, then inspect the platform repositories and the Rust dependency points. Define the platform-specific acceptance criteria and verify that the configured minimum length, passphrase entry, and strength indication behave consistently across Android and iOS.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, ios, rust
- Domain
- mobile-dev
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100