element-hq / element-hq/element-web
element-desktop authentication and device management via web browser expose users to security risks
- Dominant language
- TypeScript
- Stars
- 13.5k
- Forks
- 2.8k
- PR merge metrics
- PR metrics pending
Description
### Your use case
#### What would you like to do?
Log in to my homeserver matrix account without element-desktop automatically opening a web browser.
#### Why would you like to do it?
Because running element-desktop in one sandbox / jail, automatically opening a web browser that runs in a separate sandbox / jail is not possible (or quite complicated) to configure. Meaning the "automatically open homeserver authentication dialogue via web browser" function opens a browser in the wrong jail context, typically that means completely unjailed.
Then, the homeserver URL is https, which exposes the users' home folder to all weak spots in the browser security. A malicious homeserver operator (or a third party) could inject exploits into the authentication page that might then be able to access the users homefolder, unprotected by the sandbox normally used.
Edit/addition: Same problem is - since some recent change - true for the new device management: trying to delete / sign out a device also requires to use a web browser, and again does not provide a link to manually copy & paste but auto-opens the web browser, disregarding jail configurations.
#### How would you like to achieve it?
Log in to my homeserver matrix account without opening a web browser. Alternatively, being able to copy & paste a link myself and get a login token that I can copy & paste back into element-desktop.
### Have you considered any alternatives?
The copy & paste solution is the considered alternative.
### Additional context
The sandbox here is firejail, and the browser gets opened via DBUS (if I understood that correctly), which is another problem in and of itself.
Contributor guide
Assessment
This issue has not been assessed yet.