element-hq / element-hq/element-web
Your cross-signing keys can be silently reset after entering your recovery key
- Dominant language
- TypeScript
- Stars
- 13.5k
- Forks
- 2.8k
- PR merge metrics
- PR metrics pending
Description
### Steps to reproduce
This happens if any private cross-signing keys are missing both locally and in 4S. This situation can be arrived at by following the reproduction instructions for https://github.com/element-hq/element-web/issues/31187
After that, there should be a "Verify this session" toast (or a "Key storage out of sync toast", if 31187 is fixed).
1. click on the "Verify" button, and select "Verify with Recovery Key".
2. open the Network tab of the browser's developer tools
3. enter your recovery key and hit "Continue"
4. see that it prompts you to enter your account password
5. see that the Nework tab has a `POST /_matrix/client/v3/keys/device_signing/upload` request
### Outcome
#### What did you expect?
Clearly, if cross-signing keys are missing both locally and in 4S, it needs to create new ones, however, it should at least warn the user it is going to do so, rather than doing it nearly silently (the only indication to the user that it has done that is that it prompts for the account password, but doesn't say why it's asking). Especially since we now warn other users when your cross-signing keys have changed. So other users might ask you if your cross-signing keys changed, but you might have no knowledge of that happening.
### Operating system
_No response_
### Browser information
_No response_
### URL for webapp
_No response_
### Application version
_No response_
### Homeserver
_No response_
### Will you send logs?
Yes
Contributor guide
Assessment
This issue has not been assessed yet.