element-hq / element-hq/element-web
Element offers to verify with Security Key when security key has been deleted
- Dominant language
- TypeScript
- Stars
- 13.5k
- Forks
- 2.8k
- PR merge metrics
- PR metrics pending
Description
1. Settings -> Encryption -> Advanced -> Reset cryptographic identity. (Alternatively: set `m.secret_storage.default_key` account data to `{}` via devtools)
2. Confirm, enter password, etc
3. log out
4. Log in.
5. Observe:
The security key has been deleted; it is impossible to verify with it and we should not offer to verify with it.
Similarly
1. Do the above, skip the "verify this device" modal
2. Settings -> Encryption -> Verify this device
3. 
This is a bug in `SetupEncryptionStore`, which checks if `m.cross_signing.master` is stored in secret storage, but does not check if it is encrypted with the current secret storage key.
Contributor guide
Assessment
This issue has not been assessed yet.