changing password should not log out all your devices (and destroy your e2e history)

[ara4n]

which apparently it does as it logs out all your clients

[richvdh]

any suggestions for how to fix this welcome

[ara4n]

special-case logout caused by password reset not to destroy e2e keys? password reset should not be used to kick out lost/stolen devices - that should be explicitly done by the lost/stolen device API surely...

[richvdh]

Those sentences seem to be opposing suggestions?

special-case logout caused by password reset not to destroy e2e keys?

For one, that would require a way to tell the difference, and for two, I worry that keeping e2e keys around on logged-out clients would be surprising to the user and a leak waiting to happen.

password reset should not be used to kick out lost/stolen devices - that should be explicitly done by the lost/stolen device API surely...

Yes, one option would be to not invalidate access tokens on password reset, and instead get users to manage their access tokens via the device API: but that isn't really an e2e thing. (It doesn't seem to be specced, so I guess it's just a synapse thing).

[ara4n]

yup, they were two different suggestions.

let's just make password-reset not log out all your devices, and instead direct the user to use the devices UI to decide which devices to remove (warning them there that it will nuke the e2e history on those devices). And yes, it has nothing to do with with e2e.

In the short term, please can we just very loudly warn that it will destroy your e2e history.

[madduck]

I see two points here:

1. Resetting the password should not log out users, but probably inject a password prompt into the existing session to prompt for the new password on all devices, which then gets updated.
2. The e2e keys must not depend on the password itself, but on an underlying per-device secret key. On password change, this secret key gets decrypted with the old password and encrypted anew with the new password. e2e won't be affected.

[madduck]

Note that this also applies to changing the password!

[lhunath]

Does element-hq/element-meta#647 obsolete this?

[richvdh]

Not really. The fix to element-hq/element-meta#647 would require the user to validate the new devices. In this case it's better not to invalidate the existing devices, to avoid that step.