element-hq / element-hq/element-web
When Security Key is changed on another client during web login, web ignores the new key and blocks
- Dominant language
- TypeScript
- Stars
- 13.5k
- Forks
- 2.8k
- PR merge metrics
- PR metrics pending
Description
### Steps to reproduce
1. Web session and android session are setup, with secure backup with security key. They decrypt messages, all good.
2. web : log out.
3. web : input username and password
4. web : You are now here
5. web : Click Verify with Security Key. You are now here (AccessSecretStorageDialog) :
6. android : recreate the security key.
7. web : input the new security key
### Outcome
#### What did you expect?
Security key is right, I can continue to login
#### What happened instead?
Web client says security key is wrong, I cannot continue.
#### Workaround and additional info
If instead I do these same steps in a different order, I can continue :
6. android : recreate the security key.
5. web : Click Verify with Security Key. You are now in AccessSecretStorageDialog
7. web : input the new security key
Or if I do the buggy flow, but then add steps :
8. Click Go back
9. Click Verify with Security Key. You are now in AccessSecretStorageDialog
10 : input the new security key : it works
Conclusion : opening the AccessSecretStorageDialog seems to initialise something, that is then not refreshed to take into account the change that is made to secret storage.
#### How this happened in real life
This bug has really been encountered by a user who was blocked.
She found herself logged out on web client (maybe her browser storage had been erased because of lack of space on disk?)
She logged in again and could not find her security key.
Since she had a session on android, she regenerated the security key on android.
She input it in web and was blocked.
### Operating system
macos or windows
### Browser information
_No response_
### URL for webapp
app.element.io
### Application version
Element version: 1.11.59 Crypto version: Rust SDK 0.7.0 (fac36bc), Vodozemac 0.5.1
### Homeserver
matrix.org
### Will you send logs?
No
Contributor guide
Assessment
This issue has not been assessed yet.