element-hq
When Security Key is changed on another client during web login, web ignores the new key and blocks
Steps to reproduce
-
Web session and android session are setup, with secure backup with security key. They decrypt messages, all good.
-
web : log out.
-
web : input username and password
-
web : You are now here
-
web : Click Verify with Security Key. You are now here (AccessSecretStorageDialog) :
-
android : recreate the security key.
-
web : input the new security key
Outcome
What did you expect?
Security key is right, I can continue to login
What happened instead?
Web client says security key is wrong, I cannot continue.
Workaround and additional info
If instead I do these same steps in a different order, I can continue : 6. android : recreate the security key. 5. web : Click Verify with Security Key. You are now in AccessSecretStorageDialog 7. web : input the new security key
Or if I do the buggy flow, but then add steps : 8. Click Go back 9. Click Verify with Security Key. You are now in AccessSecretStorageDialog 10 : input the new security key : it works
Conclusion : opening the AccessSecretStorageDialog seems to initialise something, that is then not refreshed to take into account the change that is made to secret storage.
How this happened in real life
This bug has really been encountered by a user who was blocked. She found herself logged out on web client (maybe her browser storage had been erased because of lack of space on disk?) She logged in again and could not find her security key. Since she had a session on android, she regenerated the security key on android. She input it in web and was blocked.
Operating system
macos or windows
Browser information
No response
URL for webapp
app.element.io
Application version
Element version: 1.11.59 Crypto version: Rust SDK 0.7.0 (fac36bc), Vodozemac 0.5.1
Homeserver
matrix.org
Will you send logs?
No
I am working on understanding the code around this. There's a lot of stuff :) If you have any ideas of where to look it's welcome. Otherwise I'll just carry on!
Le même problème chez Element : https://github.com/element-hq/element-web/issues/27155 ?
@t3chguy Yes 🤣 Sorry, a mistake on my side. You can delete my comment before we go round and round !
