matrix-org / matrix-org/matrix-spec
"Secure"/protected account data API
Nobody has claimed this yet.
- Dominant language
- HTML
- Stars
- 330
- Forks
- 150
- Avg merge
- 2h 21m
- Merged PRs (30d)
- 3
Description
Account data, but with User-Interactive Auth (UIA) on it for more secure storage of keys. Should support *optional* UIA on read and write.
Suggested endpoint: `/_matrix/client/:version/user/:userId/protected_account_data/*`
Use cases:
* Storing sensitive but unencrypted information, such as a user's full address.
* *Note*: The client could obviously encrypt the data itself before putting it in the protected account data, however the default for the endpoint is plain text.
* Storing recovery keys for TOTP
* Avoiding helper APIs for protected writes to account data (terms auth, etc)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the proposed `/_matrix/client/:version/user/:userId/protected_account_data/*` endpoint and the existing account-data and User-Interactive Auth specifications. Define the API behavior for optional UIA on both reads and writes, covering the sensitive-data and recovery-key use cases. Done means the specification clearly describes the protected account-data endpoint and its authentication behavior.
Written by the indexing model from the issue text.
Assessment
- Domain
- api, authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100