search

element-hq / element-x-ios

Next generation Matrix client for iOS built with SwiftUI on top of matrix-rust-sdk.
https://element.io/labs/element-x
GNU Affero General Public License v3.0
400 stars 87 forks source link

Logging out of EXI did not remove the device from my device list. #2434

Open ara4n opened 7 months ago

ara4n commented 7 months ago

Steps to reproduce

  1. I was logged in on my main account on TF builds on my iPhone with device ID UQPAUDSUCS
  2. I logged out, in order to switch user to @matthew:element.io to test OIDC for FOSDEM - probably on Feb 2 or 3rd
  3. Others (e.g. Manu) see that device as untrusted now in EDR.

Searching rageshakes for that device ID gives loglines from EDR like:

2024-02-08T08:27:48.652Z W WARN matrix_sdk_crypto::identities::manager: Failed to update device keys
    user_id="@matthew:matrix.org" device_id="UQPAUDSUCS" error=VerificationError(Signature(signature::Error { source: Some(Verification equation was not satisfied) }))
    at /home/runner/.cargo/git/checkouts/matrix-rust-sdk-1f4927f82a3d27bb/5957d96/crates/matrix-sdk-crypto/src/identities/manager.rs:231

Outcome

What did you expect?

When I log out a device, everyone should be told the device has gone.

What happened instead?

Desynced device lists. Could also be related to UTDs?

Your phone model

No response

Operating system version

No response

Application version

whatever TF would have been around Feb 2nd, i suspect

Homeserver

No response

Will you send logs?

No

pixlwave commented 7 months ago

1.5.4 (1) is likely a custom build. The build number for 1.5.4 should be 88.

ara4n commented 7 months ago

hm. well, that's just what i have installed currently. i can't remember where it came from - maybe Diawi to experiment with filters UI?

ara4n commented 7 months ago

i doubt the version number is relevant here - the whole "logging out doesn't get picked up by device lists" is a problem i've seen a bunch in the past whatever

pixlwave commented 7 months ago

Sorry I wasn't implying that was the issue (it's likely because we proceed to delete the user data if the logout request fails as we never wanted to block a user from signing out in bad network conditions etc).

stefanceriu commented 6 months ago

I'm adding the needs product label here as it's their choice if we block logout under bad network conditions or not