element-hq / element-hq/element-web

Your cross-signing keys can be silently reset after entering your recovery key

Open
#31,191 1 comment 0 reactions 0 assignees View on GitHub
A-E2EE A-E2EE-Cross-Signing O-Uncommon S-Minor T-Defect
Dominant language
TypeScript
Stars
13.5k
Forks
2.8k
PR merge metrics
PR metrics pending

Description

### Steps to reproduce

This happens if any private cross-signing keys are missing both locally and in 4S. This situation can be arrived at by following the reproduction instructions for https://github.com/element-hq/element-web/issues/31187

After that, there should be a "Verify this session" toast (or a "Key storage out of sync toast", if 31187 is fixed).

1. click on the "Verify" button, and select "Verify with Recovery Key".
2. open the Network tab of the browser's developer tools
3. enter your recovery key and hit "Continue"
4. see that it prompts you to enter your account password
5. see that the Nework tab has a `POST /_matrix/client/v3/keys/device_signing/upload` request

### Outcome

#### What did you expect?

Clearly, if cross-signing keys are missing both locally and in 4S, it needs to create new ones, however, it should at least warn the user it is going to do so, rather than doing it nearly silently (the only indication to the user that it has done that is that it prompts for the account password, but doesn't say why it's asking). Especially since we now warn other users when your cross-signing keys have changed. So other users might ask you if your cross-signing keys changed, but you might have no knowledge of that happening.

### Operating system

_No response_

### Browser information

_No response_

### URL for webapp

_No response_

### Application version

_No response_

### Homeserver

_No response_

### Will you send logs?

Yes

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.