Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

"Never send encrypted messages to unverified devices in this room from this device" seems to be ignored if enabled #9235

Closed
r4dh4l opened this issue Mar 21, 2019 · 2 comments
Closed

"Never send encrypted messages to unverified devices in this room from this device" seems to be ignored if enabled #9235

r4dh4l opened this issue Mar 21, 2019 · 2 comments
Assignees
@turt2live
Labels
A-E2EE P1 S-Critical Prevents work, causes data loss and/or has no workaround T-Defect

Comments

@r4dh4l
Copy link

r4dh4l commented Mar 21, 2019 •
edited
Loading

Description

If I enable the security option "Never send encrypted messages to unverified devices in this room from this device" for an encrypted room I can choose "send anyway" in the "unknown devices" warning and the message will be send.

Steps to reproduce

  1. Enable encryption for a room.
  2. Enable "Never send encrypted messages to unverified devices in this room from this device" for this room.
  3. Send a message. There should be a "unknown devices" warning. Choose "send anyway".

Describe how what happens differs from what you expected.

The message should not be send. There should be an info message instead saying something like:

"You have activated "Never send encrypted messages to unverified devices in this room from this device" in the security settings of this room and have not verified any recipients devices. Verify at least one recipient device to allow Riot to deliver your message to verified devices."

Version information

  • Platform: desktop

For the desktop app:

  • OS: GNU/Linux Debian
  • Version: 1.0.4

Edit: I have to correct my issue description a little bit although the given issue description is not wrong: Messages sent via "send anyway" are shown as "Unable to decrypt: The sender's device has not sent us the keys for this message.".
After I verified the fingerprint of the recipients device the message was readable for the recipient. So the bug seems unfortunately not to be a security problem but anyway very irritating (a message in such a room shouldn't be delivered at all).
@turt2live turt2live added P1 S-Critical Prevents work, causes data loss and/or has no workaround A-E2EE 🔥 Fire 🔥 labels Mar 21, 2019
@turt2live turt2live self-assigned this Mar 22, 2019
turt2live added a commit to matrix-org/matrix-react-sdk that referenced this issue Mar 22, 2019
@turt2live
Attach an onChange listener to the room's blacklist devices option
50614fa 
Fixes element-hq/element-web#9235

The global option in user settings is unaffected by this bug. Users who have previously set the per-room flag without success can simply refresh the page and the change will be picked up. The bug here is that the current session would not update accordingly, however.

Introduced in #2523
@turt2live turt2live mentioned this issue Mar 22, 2019
Merged
@turt2live
Copy link
Member

This ultimately only affects the per-room option. The global option works fine. Refreshing the page after setting the flag does do the right thing, however the current session was not affected.

Introduced in matrix-org/matrix-react-sdk#2523 and fixed by matrix-org/matrix-react-sdk#2817

@r4dh4l
Copy link
Author

r4dh4l commented Mar 23, 2019 •
edited
Loading

thx for your reply @turt2live.

I have to correct my issue description a little bit although the given issue description is not wrong: Messages sent via "send anyway" are shown as "Unable to decrypt: The sender's device has not sent us the keys for this message.".
After I verified the fingerprint of the recipients device the message was readable for the recipient. So the bug seems unfortunately not to be a security problem but anyway very irritating (a message in such a room shouldn't be delivered at all).

su-ex added a commit to SchildiChat/element-web that referenced this issue Sep 15, 2022
@su-ex
Merge tag 'v1.11.5' into sc
5c1a172 
* Device manager - hide unverified security recommendation when only current session is unverified ([\element-hq#9228](matrix-org/matrix-react-sdk#9228)). Contributed by @kerryarchibald.
* Device manager - scroll to filtered list from security recommendations ([\element-hq#9227](matrix-org/matrix-react-sdk#9227)). Contributed by @kerryarchibald.
* Device manager - updated dropdown style in filtered device list ([\element-hq#9226](matrix-org/matrix-react-sdk#9226)). Contributed by @kerryarchibald.
* Device manager - device type and verification icons on device tile ([\element-hq#9197](matrix-org/matrix-react-sdk#9197)). Contributed by @kerryarchibald.
* Description of DM room with more than two other people is now being displayed correctly ([\element-hq#9231](matrix-org/matrix-react-sdk#9231)). Fixes element-hq#23094.
* Fix voice messages with multiple composers ([\element-hq#9208](matrix-org/matrix-react-sdk#9208)). Fixes element-hq#23023. Contributed by @grimhilt.
* Fix suggested rooms going missing ([\element-hq#9236](matrix-org/matrix-react-sdk#9236)). Fixes element-hq#23190.
* Fix tooltip infinitely recursing ([\element-hq#9235](matrix-org/matrix-react-sdk#9235)). Fixes matrix-org/element-web-rageshakes#15107, matrix-org/element-web-rageshakes#15093 matrix-org/element-web-rageshakes#15092 and matrix-org/element-web-rageshakes#15077.
* Fix plain text export saving ([\element-hq#9230](matrix-org/matrix-react-sdk#9230)). Contributed by @jryans.
* Add missing space in SecurityRoomSettingsTab ([\element-hq#9222](matrix-org/matrix-react-sdk#9222)). Contributed by @gefgu.
* Make use of js-sdk roomNameGenerator to handle i18n for generated room names ([\element-hq#9209](matrix-org/matrix-react-sdk#9209)). Fixes element-hq#21369.
* Fix progress bar regression throughout the app ([\element-hq#9219](matrix-org/matrix-react-sdk#9219)). Fixes element-hq#23121.
* Reuse empty string & space string logic for event types in devtools ([\element-hq#9218](matrix-org/matrix-react-sdk#9218)). Fixes element-hq#23115.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@turt2live turt2live

Labels
A-E2EE P1 S-Critical Prevents work, causes data loss and/or has no workaround T-Defect
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@turt2live @r4dh4l