t3chguy
commented
3 years ago Warning! Any messages in this chat may be lost if you log out of all devices
This just isn't true, only messages sent whilst you have 0 logged in devices will be undecryptable. You can use offline key backup or online key backup to maintain access to the existing messages.
An alternative would be to allow some kind of "placeholder" session, where when you log out on a particular device, it "freezes" an encryption key for all messages received until it logs in again, and stores the needed decryption key on the device, so when it logs in again the device itself has all the necessary information to decrypt messages left on the server in the interim.
is already possible using dehydration just isn't exposed to the user at this time.
BrenBarn
MasterJubei
OneLazyAdmin
xaur
bigbadmonster17
aaronraimist
ShadowJonathan
shrizza
DC7IA
Zocker1999NET
Description
This issue is really an Element meta-issue across all platforms.
The problem is that logging out of all devices results in any e2ee messages sent during that time becoming permanently unreadable, and this is not made clear to users, as evidenced by periodic questions from new users on the Matrix/Element rooms where people are surprised to find that logging out makes this kind of massive difference. (See also vector-im/element-web#14820.)
There are several possible solutions:
1. Do not enable e2ee by default, ever.
I find this the most appealing option. Anything that can ever make any messages permanently unreadable should not be enabled by default. I feel that the decision to enable e2ee-by-default was made without adequate consideration of the magnitude of this failure mode. Logging out is a completely normal thing to do; irrevocably losing messages is a complete code-red faceplant; that the one can lead directly to the other is a major problem.
2. Drastically increase the warnings before logging out and before turning on e2ee
Right now when you go to log out from Element you just get a confirmation dialog saying "Are you sure you want to sign out?" It should be much scarier. It should say something like "Warning! Logging out of all devices may result in permanently losing access to messages sent while you are logged out. Do you want to log out?" Perhaps it could show a summary of currently logged in devices to help the user make the decision.
The point is that anything that can lead to permanent message loss is a major decision and should be signalled as such. Either logging out is a fairly normal user action, or logging out can lead to permanent message loss; it can't be both.
A similar warning should be displayed before turning on e2ee in any room. If e2ee remains the default for 1-1 chats, a similar message should be displayed before starting a 1-1 chat (e.g., "Warning! Any messages in this chat may be lost if you log out of all devices. If you don't want this, disable e2ee with this button...").
3. Consider some kind of intermediate level of e2ee that does not have these problems
I've not delved into the details of Matrix's encryption algorithms, so I don't really know what I'm talking about here. But my understanding is that the can't-log-out problem arises because messages are encrypted with specific keys for each logged-in session, and these keys change frequently so a logged out device will "miss" the necessary key rotations. An alternative would be to allow some kind of "placeholder" session, where when you log out on a particular device, it "freezes" an encryption key for all messages received until it logs in again, and stores the needed decryption key on the device, so when it logs in again the device itself has all the necessary information to decrypt messages left on the server in the interim.
This would provide a lower level of security, but for most people it would likely be enough. (In fact, most people probably don't need e2ee at all, which is why I think I prefer option 1.) Most people are probably fine with accepting some risk of unlikely snooping modes (e.g., their homeserver operator is malicious and tries to crack the stored messages) in exchange for being able to freely log in and out whenever they choose.
Conclusion
The main point that I want to reiterate (even though I know I've reiterated it a number of times) is that permanent message loss is a doomsday scenario for a messaging system. It is bad enough that it is even possible, but might be acceptable in cases where the user explicitly accepts the tradeoffs (e.g., for greater encryption secrecy). But to enable it by default is just a bad idea; it makes it way too easy for people to lose their messages without ever even realizing that such a thing was possible.
Most people don't need e2ee to be on by default. For most users, it is more important the intended recipient does see the message than that eavesdroppers do not see the message. This is especially true because, for most users, the likelihood of anyone caring enough to eavesdrop on their messages is very low.