search

element-hq / element-web

A glossy Matrix collaboration client for the web.
https://element.io
GNU Affero General Public License v3.0
11.19k stars 2k forks source link

Security key not valid / passwords not valid / decryption broken on some sessions #16458

Open seccentral opened 3 years ago

seccentral commented 3 years ago

Description

I run a hosted synapse server. I am logged in to the synapse server using my desktop element for windows client, my phone's element for android and also fluffy. The first ever session was on my desktop, then element on android then fluffy. Since I don't have access to my desktop right now and won't for a few days I decided to install element on my laptop and that's where the fun starts.

Problems: For some reason when i tried to login again on my laptop, the password was incorrect.
Very strange since I use bitwarden for password vault storage and I didn't change the password. I also use bitwarden to keep my security key backed up. (more on this later) I was forced to reset my password via the cli hashpassword method then update the postgres database. (I was unable to find a way to do it via the api, the docs mention that the access token is somewhere in my client, I have yet to find it, and besides, if I lose access to my client then what do I do? This didn't really make much sense to me, the way the access token is obtained. Anyway, moving on. )_ I finally managed to login on my laptop and it asked me to confirm / validate my new session, i opted for the emoji method, I thought everything was ok but the client just froze at that step, clicking the buttons didn't do anything but the application itself was responding. Then, being out of options, I closed the request prompt, and to my surprise even if I wasn't yet verified I got access to my rooms and my messages. However something was not right. Some of my messages couldn't be decrypted. I believed that because i changed my password via the database i had to relogin on my element for android too. Which i did, and noticed something even stranger: I observed a very weird and inconsistent session situation: On my laptop (since my desktop is unavailable atm) I see 4 sessions, 3 trusted, one untrusted: 

Element Android Not trusted
Element Desktop (Windows) Trusted
FluffyChat android Trusted
Element Desktop (Windows) Trusted

On my Element Android i see all four of them trusted, yes i am not making this up. here is a screenshot. https://drive.google.com/file/d/1pZiZN8yUs0NQda3OUmYy8eeseShgc-fu/view?usp=sharing Element on my laptop keeps complaining about untrusted sessions that need verifying. If i attempt to verify them it asks if i want to verify manually by text or by emoji. No matter what i chose, text or emoji and confiming that they are correct in each case, it then asks me for my security key. I get the key from bitwarden and it tells me Wrong Security Key I also saved the key initially when it first prompted me to a text file. choosing upload gives the same result: Wrong Security Key. And now my laptop session gets un-decryptable messages telling me ** Unable to decrypt: The sender's device has not sent us the keys for this message. ** Clicking re-request encryption keys shows "Key request sent", however nothing happens in my element-android client. the only client that shows something is fluffy, which displays "Request to read older messages" followed by the session ID and the Public key of my element-android app. which makes no sense since i requested the keys from my element-desktop installed on my laptop. Something isn't right somewhere and i thought i should let the devs know.

Steps to reproduce

um, not really sure.

Version information

For the desktop app: OS windows 10 pro latest updates etc

jryans commented 3 years ago

I recommend trying to reset cross signing and secret storage:

  1. Consider exporting room keys to a file as a backup in an existing session via top left menu -> Settings -> Security -> Export E2E room keys (but you've said you don't have encrypted rooms at the moment)
  2. If you don't have an existing develop session, it should be fine to login and skip any verification prompts
  3. Reset secure backup first (this should now succeed without confusingly asking for previous keys)
  4. Reset cross-signing keys (this may prompt for security key / phrase, it's expecting the new one you just made in step 2)
  5. On other sessions, you should be able to either verify the new session and receive new keys or go to Settings and "setup" Secure Backup (green button instead of the red "reset"), which maybe prompt for the new security key / phrase as part of downloading your keys