We should put a big warning on the console like Facebook do to discourage social engineering attacks on localstorage

[ara4n]

No description provided.

[select]

just read this, a warning might not be the best option, but a warm welcome message explaining the dangers http://booktwo.org/notebook/welcome-js/

[t3chguy]

had a play with this, it very quickly gets moved off the visible console by all the debug messages/warnings/errors that riot spits out so they may need to be toned down on release versions to make this viable:

22:56:06.232 bundle.js:81 Initialised rageshake: See https://bugs.chromium.org/p/chromium/issues/detail?id=583193 to fix line numbers on Chrome.
22:56:06.234 bundle.js:81 Vector starting at https://riot.im/app/#/room/#matrix:matrix.org
22:56:06.272 bundle.js:81 Restoring session for @x:riot.ovh
22:56:06.272 bundle.js:81 setLoggedIn => @x:riot.ovh (guest=false) hs=https://riot.ovh
22:56:06.273 bundle.js:81 Session persisted for @x:riot.ovh
22:56:06.455 bundle.js:81 newscreen room/#matrix:matrix.org
22:56:06.541 bundle.js:81 Presence: online
22:56:06.761 bundle.js:81 IndexedDB worker is ready
22:56:08.681 isEventSupported.js:37 [Violation] 'message' handler took 186ms
22:56:08.762 rageshake.js:63 Got push rules
22:56:09.194 [Violation] 'message' handler took 235ms
22:56:09.194 rageshake.js:63 sync(): not doing HTTP hit, instead returning stored /sync data
22:56:11.642 rageshake.js:63 Error decrypting event (id=$1493055576433TDEwh:riot.ovh): DecryptionError[msg: Unknown encryption algorithm "undefined".]
e.(anonymous function) @ rageshake.js:63
o @ client.js:552
t @ client.js:3077
(anonymous) @ sync.js:1101
o._mapSyncEventsFormat @ sync.js:1097
(anonymous) @ sync.js:821
o._processSyncResponse @ sync.js:818
(anonymous) @ sync.js:601
r @ q.js:854
s.promiseDispatch.u @ q.js:883
r.promiseDispatch @ q.js:816
(anonymous) @ q.js:624
r @ q.js:137
e @ q.js:125
o @ setImmediate.js:40
a @ setImmediate.js:69
n @ setImmediate.js:109
22:56:11.872 event-timeline-set.js:456 EventTimelineSet.addLiveEvent: ignoring duplicate event $149241172595Qdegx:riot.ovh
22:56:11.883 event-timeline-set.js:456 EventTimelineSet.addLiveEvent: ignoring duplicate event $1492499772351408LxCwM:matrix.org
22:56:11.893 event-timeline-set.js:456 EventTimelineSet.addLiveEvent: ignoring duplicate event $149260819330OiEHM:riot.ovh
22:56:11.896 event-timeline-set.js:456 EventTimelineSet.addLiveEvent: ignoring duplicate event $149261423886aefmT:riot.ovh
22:56:11.918 event-timeline-set.js:456 EventTimelineSet.addLiveEvent: ignoring duplicate event $149261504297FtrpW:riot.ovh
22:56:12.654 event-timeline-set.js:456 EventTimelineSet.addLiveEvent: ignoring duplicate event $1493477661257KiEQC:riot.ovh
22:56:12.655 rageshake.js:63 MatrixClient sync state => PREPARED
22:56:12.834 rageshake.js:63 newscreen room/#matrix:matrix.org
22:56:12.900 isEventSupported.js:37 [Violation] 'message' handler took 3706ms
22:56:12.908 [Violation] Forced reflow while executing JavaScript took 38ms
22:56:13.786 [Violation] Forced reflow while executing JavaScript took 38ms
22:56:14.573 rageshake.js:63 updateTint from RoomView._gatherTimelinePanelRef
22:56:14.586 rageshake.js:63 Tinter.tint from updateTint
22:56:14.889 isEventSupported.js:37 [Violation] 'message' handler took 781ms
22:56:14.911 [Violation] Forced reflow while executing JavaScript took 140ms
22:56:16.153 [Violation] Forced reflow while executing JavaScript took 35ms
22:56:17.106 rageshake.js:63 MatrixClient sync state => SYNCING
22:56:17.173 isEventSupported.js:37 [Violation] 'message' handler took 329ms
22:56:17.316 indexeddb-local-backend.js?79bc:216 Persisting sync data up to  s58686_2203890_17159_86926_61_12_107_5147
22:56:17.650 onloadwff.js:37 [Violation] 'setTimeout' handler took 56ms
22:56:17.807 index.js:310 [Violation] 'setTimeout' handler took 86ms
22:56:17.912 index.js:310 [Violation] 'setTimeout' handler took 84ms
22:56:18.025 index.js:310 [Violation] 'setTimeout' handler took 104ms

Could do it on viewport resize (unreliable way of detecting console state) but that's still far from ideal, maybe make a localStorage flag which enables debug log and otherwise hide non-critical/bug console.logs.

[turt2live]

Apparently Discord goes as far as removing the localStorage object from the global namespace (which causes some problems, which might be acceptable for us). Source: thread surrounding https://twitter.com/dekisu/status/1127519764442693632

[ShadowJonathan]

FWIW discord also has a similar warning;