element-hq / element-hq/element-web

When Security Key is changed on another client during web login, web ignores the new key and blocks

Open
#27,155 6 comments 0 reactions 0 assignees View on GitHub
A-E2EE O-Uncommon S-Minor T-Defect
Dominant language
TypeScript
Stars
13.5k
Forks
2.8k
PR merge metrics
PR metrics pending

Description

### Steps to reproduce

1. Web session and android session are setup, with secure backup with security key. They decrypt messages, all good.
2. web : log out.
3. web : input username and password
4. web : You are now here
Screen Shot 2024-03-11 at 3 53 55 PM

5. web : Click Verify with Security Key. You are now here (AccessSecretStorageDialog) :
Screen Shot 2024-03-11 at 4 13 37 PM

6. android : recreate the security key.
7. web : input the new security key
Screen Shot 2024-03-11 at 3 54 49 PM

### Outcome

#### What did you expect?
Security key is right, I can continue to login

#### What happened instead?
Web client says security key is wrong, I cannot continue.
Screen Shot 2024-03-11 at 3 54 49 PM

#### Workaround and additional info
If instead I do these same steps in a different order, I can continue :
6. android : recreate the security key.
5. web : Click Verify with Security Key. You are now in AccessSecretStorageDialog
7. web : input the new security key

Or if I do the buggy flow, but then add steps :
8. Click Go back
9. Click Verify with Security Key. You are now in AccessSecretStorageDialog
10 : input the new security key : it works

Conclusion : opening the AccessSecretStorageDialog seems to initialise something, that is then not refreshed to take into account the change that is made to secret storage.

#### How this happened in real life
This bug has really been encountered by a user who was blocked.
She found herself logged out on web client (maybe her browser storage had been erased because of lack of space on disk?)
She logged in again and could not find her security key.
Since she had a session on android, she regenerated the security key on android.
She input it in web and was blocked.

### Operating system

macos or windows

### Browser information

_No response_

### URL for webapp

app.element.io

### Application version

Element version: 1.11.59 Crypto version: Rust SDK 0.7.0 (fac36bc), Vodozemac 0.5.1

### Homeserver

matrix.org

### Will you send logs?

No

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.