Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Resetting cross-signing/SSSS doesn't reset SSSS password #13212

Closed
dbkr opened this issue Apr 16, 2020 · 5 comments · Fixed by matrix-org/matrix-js-sdk#1322
Closed

Resetting cross-signing/SSSS doesn't reset SSSS password #13212

dbkr opened this issue Apr 16, 2020 · 5 comments · Fixed by matrix-org/matrix-js-sdk#1322
Assignees
@dbkr
Labels
A-E2EE-Cross-Signing T-Defect X-Regression X-Release-Blocker

Comments

@dbkr
Copy link
Member

dbkr commented Apr 16, 2020 •
edited
Loading

It asks for the SSSS password after prompting you for a new one, but then appears to store the new cross-signing secrets with the old SSSS key, so your password stays the same.
@jryans
Copy link
Collaborator

jryans commented Apr 16, 2020

Flagging as blocker, we definitely want a reset button that works.

@dbkr dbkr self-assigned this Apr 16, 2020
@jryans jryans mentioned this issue Apr 16, 2020
Closed
@fladd
Copy link

fladd commented Apr 16, 2020 •
edited
Loading

More importantly, the old recovery passphrase and key are still valid after the resetting procedure!

@dbkr dbkr mentioned this issue Apr 16, 2020
Closed
@dbkr dbkr changed the title Resetting cross-signing/SSSS asks for old SSSS passphrase Resetting cross-signing/SSSS doesn't reset SSSS password Apr 16, 2020
@dbkr
Copy link
Member Author

dbkr commented Apr 16, 2020

Updated the title & description to reflect this

@fladd fladd mentioned this issue Apr 16, 2020
Open
@ilmaisin ilmaisin mentioned this issue Apr 16, 2020
Closed
14 tasks
@dbkr
Copy link
Member Author

dbkr commented Apr 16, 2020

Looks like this regressed in matrix-org/matrix-js-sdk#1311

dbkr added a commit to matrix-org/matrix-js-sdk that referenced this issue Apr 16, 2020
@dbkr
Fix cross-signing/SSSS reset
12f4690 
We re-used the old SSSS key even when resetting, meaning we prompted
the user to create a new passphrase but then ignored it and kept using
the old one.

Fixes element-hq/element-web#13212
@dbkr dbkr mentioned this issue Apr 16, 2020
Merged
dbkr added a commit to matrix-org/matrix-js-sdk that referenced this issue Apr 16, 2020
@dbkr
Fix cross-signing/SSSS reset
761892d 
We re-used the old SSSS key even when resetting, meaning we prompted
the user to create a new passphrase but then ignored it and kept using
the old one.

Fixes element-hq/element-web#13212
@non-Jedi
Copy link

non-Jedi commented Apr 17, 2020 •
edited
Loading

Is key reset expected to work on Riot Android 0.9.10 and RiotX 0.18.1? After resetting it's showing a different set of devices as verified on Riot Android and RiotX than riot-web. Can file bug/send rageshake if necessary.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@dbkr dbkr

Labels
A-E2EE-Cross-Signing T-Defect X-Regression X-Release-Blocker
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Fix cross-signing/SSSS reset matrix-org/matrix-js-sdk
4 participants
@jryans @dbkr @fladd @non-Jedi