search

element-hq / element-web

A glossy Matrix collaboration client for the web.
https://element.io
GNU Affero General Public License v3.0
11.06k stars 1.97k forks source link

Can't verify, encrypted messages broken #16184

Open dcz-self opened 3 years ago

dcz-self commented 3 years ago

This is a usability issue, but not reproducible, so sorry for no pictures.

Description

At some point, Matrix started to ask to verify on login, which isn't possible. All encrypted messages come in as a notification that they can't be decrypted.

What happened exactly

  1. I logged in to Element (not the official instance)
  2. Firefox popped up a notification that the site wants to save some data.
  3. Dialog was dismissed with "no".
  4. Element showed some introduction to encryption.
  5. Closed the browser.
  6. Started the browser again.
  7. Logged in to Element. The following happens at each login.
  8. Element asks to verify using a web session (this is what I'm using), or an Android one (never existed).
  9. Element will let me know that messages can't be decrypted whenever they come encrypted.

Describe how what happens differs from what you expected.

I would have expected some way to leave this impasse.

I suspect Element lost my private key that it generated before it showed me the encryption screen. I would have expected a warning not to throw away the key before I had a chance to do it.

I suspect that my browser cleans cookies aggressively doesn't let Element keep any new keys. I would have expected some information to allow permanent storage if that is the case.

I would expect Element not to ask to verify when it's not possible.

Version information

Extra info

This can be argued is not an issue due to the user deliberately dropping storage, but the UI doesn't do anything to warn against it.

jryans commented 3 years ago

@dcz-self Thanks for the detailed feedback, I believe there may indeed be some UX gaps here.

I do have one question though... Since you say you are just closing the browser tab (presumably not signing out in the Element UI), when would you expect warnings or prompts to appear?

jryans commented 3 years ago

Related to https://github.com/vector-im/element-web/issues/16123

greve commented 3 years ago

Can I ask to please elevate this issue to severe, or at least normal? It is completely blocking usage of Element for some users, including myself, because it is impossible to verify another device - and now messages are showing up on BOTH devices as 

** Unable to decrypt: The sender has disabled encrypting to unverified devices. **
Re-request encryption keys from your other sessions.?

Re-requesting also does not work, likely due to similar issues.

Would love to verify the sessions, but whichever way I choose, I cannot. Verification by Text and Emoji both start on both devices normally. Upon confirmation on the older, authenticated device I am at the final step being asked

Security Phrase
Enter your Security Phrase or Use your Security Key to continue.

But when I enter the security phrase I once entered, it tells me that it is invalid. No idea which other phrase it wants from where.

So I try to verify with Security Key, which from other tickets I have understood to be the Recovery Key?

If I enter that, or upload it, it tells me that it is invalid.

Tried resetting it and downloading it again. Worked perfectly to restore everything in one session, was happily backing up.

Still keeps claiming it is wrong for verification.

So where is that magic Security Key, and most importantly: Why does it even ask this when I am already signed in, fully authenticated, with access to all keys?

Really frustrated at this point in time, especially about the message

VERIFICATION CANCELLED
You cancelled verification. Start verification again from the notification.

Because no. I did not. I've been trying all kinds of flows and approaches and resets and recoveries and strategies for days.

THE ONE THING I DID NOT DO WAS CANCEL.

Right now user experience feels like the Scottish Voice Recognition Elevator.

And in case the reference is lost on someone: https://www.youtube.com/watch?v=TqAu-DDlINs

jryans commented 3 years ago

@greve Sorry to hear about your troubles. There are many similar sounding issues in this space, I am not convinced yours is the same as the original issue author here. Please open a new issue for your situation, and send debug logs as well.

greve commented 3 years ago

@greve Sorry to hear about your troubles. There are many similar sounding issues in this space, I am not convinced yours is the same as the original issue author here. Please open a new issue for your situation, and send debug logs as well.

Thank you for your response. Just did as requested as https://github.com/vector-im/element-web/issues/16413

Also asked Element to upload debug logs directly, it said that the operation succeeded.

Let me know if you need anything else and thank you for your help.

dcz-self commented 3 years ago

I do have one question though... Since you say you are just closing the browser tab (presumably not signing out in the Element UI), when would you expect warnings or prompts to appear?

I don't think I have a good answer to that, but here's what I have. I would definitely stop and pay attention if I got a message "we'll generate your encryption key now. Make sure to accept the next dialog" before Firefox prompted me about storing data. The downside is that this adds another step to the process, and not everyone might have a clue about encryption.

Another thing that would have definitely worked for me is it Element detected that the keys did not get saved permanently and gave me access to the plain text, along with instructions for importing them again. Or some way to retry the process.

If there's no way to detect if the user accepted the data storage, then I might have gave it a thought if I got told something along the lines of "now you can use end to end encryption!". I might then realize that it doesn't quite click without a permanent place for keys, and would click any "learn more" button hoping that it tells me where the keys are stored.

uhoreg commented 2 years ago

It sounds like the main issue here is that Element should detect if it is able to use IndexedDB, and if not, display some sort of warning that things may not work properly.