element-hq / element-hq/element-x-android

Element X does not warn or indicate when an unverified device logs in to my account

Open
#5,790 0 comments 0 reactions 0 assignees View on GitHub
A-E2EE O-Occasional S-Major T-Defect X-Security
Dominant language
Kotlin
Stars
2.4k
Forks
624
Avg merge
1d 14h
Merged PRs (30d)
149

Description

### Steps to reproduce

1. Log in to a account with Element X, and make sure encryption is set up and working.
2. Log in to that account with a client other than Element X, thereby creating a new device ID with new device keys. Do not verify this new device.
3. Open the original Element X session.

### Outcome

#### What did you expect?

Some kind of warning about the new unverified device that logged in to my account, or at least a notice, and a perhaps a reminder to verify it.

#### What happened instead?

There was no indication whatsoever that a new, unsigned device had logged in to my account. No warning. No prompt. No "was this you?" message. Nothing.

Even the Manage Devices web view lacks any indicator that the device is unverified. It looks just like the verified devices and those that have no device keys (do not participate in encryption).

This is problematic, especially if Element X is the only client I regularly use, because:

- I am left with no idea that a new device is now on my account, potentially monitoring my activity.
- I am not warned that my login password might have been compromised.
- I have no way of discovering which of my other devices still need verification.
- I have no information about how my account will appear to my contacts. I won't know until they complain to me, at which point I have already inconvenienced them. Or if they don't complain, I will be persistently inconveniencing them without knowing it. This also complicates things when I'm trying to guide someone through setting up Matrix for themselves, since I won't be able to tell them what they should expect to see when communicating with me.

### Your phone model

_No response_

### Operating system version

Android 14

### Application version and app store

Element X 25.11.0 f-droid

### Homeserver

matrix.org

### Will you send logs?

No

### Are you willing to provide a PR?

No

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.