element-hq / element-hq/element-meta

Clients must present sufficient E2EE-related information to assist debugging/compromise detection

Open
#642 0 comments 0 reactions 0 assignees View on GitHub
A-Developer-Experience A-E2EE App: Android App: iOS App: web O-Occasional S-Major T-Enhancement
Dominant language
No language data
Stars
112
Forks
25
Avg merge
6h 6m
Merged PRs (30d)
4

Description

Clients must unify the way they present E2EE-related information, to assist in debugging and detecting a potential compromise. Each client must be able to display all of the following:

- [ ] Must display device IDs for *each* device
- [ ] Display room key backup information
- [ ] Backup version
- [ ] Backup algorithm
- [ ] Number of keys in backup
- [ ] Backup signatures
- [ ] Whether a signature is valid
- [ ] Whether a signature is trusted
- [ ] Whether the signature is from a device or a user identity
- [ ] If from device, must show both the device display name and device ID (even if the signature is trusted!)
NOTE: This is currently not the case for Element Web/Desktop. If the signature is trusted, we only display the device display name, but not the device ID.
- [ ] If from user identity, must show the public MSK of the identity
- [ ] Whether the backup is being used to upload keys (also need to differentiate between old and new keys, if the client differentiates between those cases)
- [ ] Whether the backup is being used to fetch keys
- [ ] Must have a way of showing the current user identity (public cross-signing keys)
- [ ] MSK
- [ ] USK
- [ ] SSK

Contributor guide

No contributing guide indexed for this repository

Research direction

No files, tests, or entry points are named; begin by identifying the affected Element clients and their existing E2EE, backup, and cross-signing information views. Done means each client presents the listed device IDs, backup details and signature state, upload/fetch status, and current user identity keys in a consistent way.

Written by the indexing model from the issue text.

Assessment

Domain
security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.