Unintentional logout should allow key backup

element-hq / element-meta

Shared/meta documentation and project artefacts for Element clients

75 stars 12 forks source link

Unintentional logout should allow key backup #1419

Open TheJJ opened 5 years ago

TheJJ commented 5 years ago

Description

When, for whatever reason, one is logged out (password change vector-im/element-web#2671, funny security incidents, ...), riot-web should provide the possibility to download the E2E keys.

Steps to reproduce

Use Riot with E2E-Rooms
Wait to be logged out
Discover that you did not set up/create key backup etc
E2E data can't be exported conveniently since one is logged out

Steps to fix

Add some UI displayed after an unintentional logout to export E2E keys

exuvo commented 5 years ago

With the recent matrix.org security breach I too was forced to re-login, but the desktop client then forgets all the room keys which is weird as those should already be stored locally at that point?

Describe the solution you'd like Allow for exporting keys before the client does a forced logout.

Workaround I was forced to restore my riot data directory from backups and restart riot with internet disabled (which keeps the client from logging me out instantly) to be able to export the E2E room keys.

xloem commented 5 years ago

Note that if you have no backup an individual with experience in data-recovery or a tool such as autopsy should be able to recover the keys, if the computer is not left powered on for too long after the incident.