element-hq / element-hq/synapse

Invited users don't trigger device_list updates when their device lists change.

Open
#3,504 2 comments 0 reactions 0 assignees View on GitHub
A-Device-List-Tracking A-E2EE A-Invite T-Defect
Dominant language
Python
Stars
4.6k
Forks
600
Avg merge
5d 22h
Merged PRs (30d)
51

Description

This issue has been migrated from [#3504](https://github.com/matrix-org/synapse/issues/3504).

---

If you invite a user to an E2E chat, you have no way of being told when its device list changes as it is not yet participating in the room. As a result, any added devices won't be encrypted for. Options to fix this include:

* Have invited users participate in the room DAG. This poses a security issue however given you can obligate any user to unilaterally participate in a room DAG.
* Synchronise device_lists using a different mechanism than basing it off DAG membership; e.g. a separate pubsub mechanism for tracking a given user's device updates (see the second half of https://github.com/vector-im/riot-web/issues/6989#issue-339179869)
* Use cross-user KS reqs to recover the missing keys.
* Refuse to share history with non-joined users.

Related to https://github.com/matrix-org/synapse/issues/3503.

This has been split out from https://github.com/vector-im/riot-web/issues/2713#issuecomment-402989021.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.