element-hq / element-hq/element-web

Two devices signing in simultaneously, they offer to cross sign _each other_ D:

Open
#25,720 4 comments 0 reactions 0 assignees View on GitHub
A-E2EE-SAS-Verification A-Session-Mgmt O-Uncommon S-Major T-Defect
Dominant language
TypeScript
Stars
13.5k
Forks
2.8k
PR merge metrics
PR metrics pending

Description

### Steps to reproduce

Having had some problems with Element Desktop on Mac and Windows recently, I decided to reinstall both from the website.

I did this, and fired up both fresh installs simultaneously.

The Windows build found the application state from the previous install, so I clicked "logout" to start afresh.
The Mac build took me to the login page.

I logged in on both simultaneously. I was observing the Mac build and it prompted me to verify - I chose _verify with another device_, wondering if Element X on my phone supported cross signing yet.

To my surprise, the Mac build went on to the emoji compare without my clicking anything else on any other device. When I looked at the Windows build, it was showing me the same emoji.

First I was surprised that the Windows build had chosen to complete verification between the Mac build and it without input from me. _Then_ I was surprised that the two fresh unverified devices were willing to verify each other at all. I didn't proceed, but I assume it would have been bad news for my existing verified devices if the two newbies had set up a new circle of trust?

Oh, and now both Element Desktop installs are now unresponsive. Windows is a white screen, Mac is not responding to mouse clicks with the green "Verify this session" shield. I'll make another issue for this.

### Outcome

#### What did you expect?
1. Verification not to proceed to emoji-comparing stage without human interaction
2. Two unverified devices not to offer to verify each other when there are other, active, verifed devices

#### What happened instead?
Not those things

### Operating system

Windows 10 Pro, Mac Ventura 13.2.1

### Application version

Latest stable, can't verify because both installs are unresponsive.

### How did you install the app?

Website

### Homeserver

lant.uk

### Will you send logs?

No

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.