element-hq / element-hq/element-web

Events "Sent from an insecure device" are not updated when we receive the correct cross-signatures for the device.

Open
#32,822 1 comment 0 reactions 0 assignees View on GitHub
A-E2EE-Cross-Signing O-Occasional S-Minor T-Defect Team: Crypto
Dominant language
TypeScript
Stars
13.5k
Forks
2.8k
PR merge metrics
PR metrics pending

Description

Not sure of exact repro steps, but something like:

1. Receive a message from someone you haven't met before
2. Observe "Sent from an insecure device"
3. Check devtools, discover their device is in fact signed correctly.

The problem is that it can be a few seconds before we receive the user's identity, and we don't update the UI when that happens.

Specifically [this line](https://github.com/matrix-org/matrix-js-sdk/blob/c2f9ad28fc1e694931536bbe64b2d4757dc0eb34/src/rust-crypto/rust-crypto.ts#L2393) means that we don't attempt retries on events which fail due to "unsigned device". As a side note, the error message on line 2396 is misleading: `UnsignedSenderDevice` means it is the device that is not correctly cross-signed, not the identity.

We should probably consider the other error codes and decide if any of them need updates while we're in the area.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.