element-hq / element-meta

Shared/meta documentation and project artefacts for Element clients
75 stars 12 forks source link

Element is not a functioning messaging application at low live session counts #1894

Open pfdint opened 3 years ago

pfdint commented 3 years ago

Encrypted messages cannot be received (decrypted) when the number of living sessions is zero.

What I expect from a messaging application: I log in and read messages sent to me. I log out and go do things. I log back in and read the messages sent to me while I was away.

Element does not actualize this basic functionality.

1) When I log out, meaning when I kill the final living session, messages sent to me are never able to be decrypted. I log in and verify using security phrase, but the messages sent while the number of living sessions was zero are lost forever. Those messages have a link to request keys from other sessions. But there are no other sessions.

2) The same effect is true when zombie sessions exist. When a user closes Element but does not sign out, the session lives on but becomes inaccessible, creating a zombie session. Restoring using security phrase does not decrypt the messages. Those messages have a link to request keys from other sessions. But the other sessions are all permanently lost. Whether invoking the security phrase fails because a decryption action simply isn't triggered or whether the relevant keys are not in the backup I cannot say.


To reproduce 1):

To reproduce 2), which is likely a variation on 1):

This occurs on the web client on at least chrome 90 and firefox 89, archlinux. app.element.io

This may be what vector-im/element-web#16184 refers to.

pfdint commented 3 years ago

Also invoking vector-im/element-meta#1868, vector-im/element-web#14323, vector-im/element-web#13388

BrenBarn commented 2 years ago

vector-im/element-meta#310 is also related. But I think you have stated the issue succinctly and I quite agree. The way people expect a messaging app to work is that when you log in with your username and password you have access to every message ever sent to that username, period. Element does not conform to that expectation (and neither does Matrix as a whole, since as far as I can tell no other client even handles encryption as well as Element does, let alone as well as Element should).