element-hq / element-hq/element-web

Security: Windows re-install auto-logs into previous session after uninstall (credentials not purged from OS keychain)

Open
#32,019 16 comments 0 reactions 0 assignees View on GitHub
A-Authentication A-E2EE A-Electron A-Session-Mgmt A-Storage good first issue Help Wanted O-Frequent O-Uncommon S-Critical S-Minor T-Defect
Dominant language
TypeScript
Stars
13.5k
Forks
2.8k
PR merge metrics
PR metrics pending

Description

### Steps to reproduce

1. Windows 11 x64, fresh user profile (no other Matrix apps running).
2. Install Element Desktop 1.11.112 (official x64 installer).
3. Start Element, log in with @user:server (E2EE on; Secure Backup/Recovery Key set).
4. Close Element.
5. Uninstall Element Desktop via “Apps & Features” (no special options). Do NOT touch Windows Credential Manager.
6. (Optional) Delete `%APPDATA%\Element` — not required to reproduce.
7. Re-download and install Element Desktop 1.11.112 again.
8. Launch Element Desktop.

### Outcome

### What did you expect?
- After uninstall, all local secrets (tokens/keys) are purged.
- A fresh install should require full authentication (password + device verification or recovery key).
- No automatic access to the previous user’s E2EE chats.

### What happened instead?
- Element Desktop opens **already logged in** to the previous session immediately after re-install.
- Full room list and encrypted message history are accessible **without any authentication**.
- No warning during uninstall that OS keychain/DPAPI credentials will remain on the machine.

**Environment**
- Element Desktop: 1.11.112 (Windows x64)
- Crypto stack: Rust SDK 0.13.0 (f64839e), Vodozemac 0.9.0
- OS: Windows 11 x64 (also reproducible on Windows 10)
- Homeserver: self-hosted Synapse
- E2EE: enabled (Secure Backup + Recovery Key)

**Security impact**
- On shared Windows accounts (internet cafés, labs, VDI), the next user can read/send as the prior user after a simple re-install.
- Severity: **High (local)**.

**Notes**
- Element Desktop appears to keep credentials/keys in **Windows Credential Manager (DPAPI)** via keytar.
- Uninstaller does not purge those entries; clearing `%APPDATA%` alone is insufficient.

**Proposed fix**
- Uninstaller should prompt **“Remove all local secrets (including OS keychain)?”** — default **ON**.
- Provide an in-app **“Wipe local secrets (incl. OS keychain + IndexedDB)**

### Operating system

Windows 11 Pro 24H2

### Application version

Element Desktop: 1.11.112

### How did you install the app?

https://packages.element.io/desktop/install/win32/x64/Element%20Setup.exe

### Homeserver

_No response_

### Will you send logs?

No

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.