element-hq / element-hq/element-meta

Better handling of misconfigured encryption in room

Open
#69 9 comments 0 reactions 2 assignees Claimed by @amshakal View on GitHub
Team: Crypto X-Needs-Design
Dominant language
No language data
Stars
112
Forks
25
Avg merge
6h 6m
Merged PRs (30d)
4

Description

A room is set as encrypted when a state event of type `m.room.encryption` is set.
There is no UI to update such state events, but a state event can be sent by a room admin using devtools for example \(user with enough Power Level to send state events\)

Currently some clients ignores m.room.encrytion state events when there is already one in the room, but it's problematic because new logins will only see the latest resolved state, and woud have to resolve the full history of that state to decide what to with that room.

We decided to follow a more pragmatic approach:
- If there is a `m.room.encryption`state event, consider the room as e2e \(no matter what the content of the event is\)
- If the `m.room.encryption` is malformed or refer to an unknown algorithm, then consider the encryption as missconfigured and block sending in that room \(until fixed by a state update\)
- If the event is correct and using megolm algorithm \(`m.megolm.v1.aes-sha2`\), then the room is correctly configured and the user can send messages

For live `m.room.encryption` state event received, never ignore and store value:

- If an invalid `m.room.encryption` is received -> Mark the room as encrypted but Deny sending
- If a valid `m.room.encryption` is received with unknown alg -> Same \(Mark the room as encrypted but Deny sending\)

=> If a follow up valid m.room.encryption with correct alg is received, client should repair the room and allow sending.

\(FTR currently on web, if encryption is using an unknwon algorithm sending in the room would be broken. Each event would fail to send, so better to deny sending\)

## UX to deny sending when encryption is misconfigured

Should use the same ux system as when the user can't send due to power levels \(hiding / disabling text composer\):
image
^ Sample on android \(copy and icon to be defined\)

A specific icon should be displayed on top bar to reflect misconfigured state
image

The encryption tile in timeline should also reflect the state

image

We should no more see ignored encryption tiles
image

## The settings screen should also reflect that state, and offer a action/button for admin that would fix encryption\)

image

^ Icons / Copy to be defined via design

Dev issues:

- \[x\] https://github.com/vector-im/element-android/issues/4711
- \[ \] https://github.com/vector-im/element-ios/issues/5322
- \[ \] https://github.com/vector-im/element-web/issues/20247
- \[ \] https://github.com/vector-im/hydrogen-web/issues/620

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.