element-hq / element-hq/element-web
Warn users when setting up key backup that the admin can crack weak passwords
Open
A-E2EE-Key-Backup
T-Enhancement
- Dominant language
- TypeScript
- Stars
- 13.5k
- Forks
- 2.8k
- PR merge metrics
- PR metrics pending
Description
Users not familiar with cryptography doesn't even understand **what that password does and why is it important**. And if they doesn't understand it, **they won't set strong passwords**. They will set the easiest to remember (and crack) password.
So I suggest similar wording:
> Save my conversation encryption keys to the server, protected with the same password (WARNING: If you give a weak password, the server admin can break it, and _read all your conversations!_ If you don't know what makes a password cryptographically secure, then don't use this feature!)
Contributor guide
Assessment
This issue has not been assessed yet.