3 ms·

I've filed https://github.com/matrix-org/matrix-doc/issues/3290; https://github.com/matrix-org/matrix-doc/issues/3290; unfortunately this is a spec issue (the c

I've filed https://github.com/matrix-org/matrix-doc/issues/3290; https://github.com/matrix-org/matrix-doc/issues/3290; unfortunately this is a spec issue (the current spec mandates that any 401 error is treated as the server telling the client to do a hard logout. i propose it should do a soft logout by default instead, thus preserving local data).

kragen 5y ago
Thanks! Yeah, it was an extremely rude awakening, and I've lost months of logs of conversations that I thought were securely in my possession. From my point of view, if there's anything the server that can do that will cause my client to delete data, that's a security hole in the client that should be fixed—I want to run a client that is a user agent, serving my interests as a user, not a server agent, acting on behalf of the server. It seems like the authors of the spec had the opposite perspective on this? Of course a DHTML web page is a server agent; it's just a convenient way for the server to get better responsiveness and resilience against network failures. It relies on the server completely for its integrity—the server can inject whatever code it wants. So the server-agent mindset is understandable for a team that started out developing a DHTML web page. But a phone or desktop app doesn't have to work that way; it can protect the user from malicious servers. And, I think, it should.
pkulak 5y ago
Why would a server failure 401? The spec seems reasonable to me. This looks like some kind of proxy setup mistake, maybe?
- kragen 5y ago
  I haven't asked A., but as I said, I suspect she was reinstalling the server from scratch, and hadn't yet gotten to the part where she restored the database from backups. So all login attempts were failing. I didn't yet realize there was a server problem, myself. I thought Element on my phone was failing and that I was misremembering the password when I tried to log in from the browser. Generally, though, regardless of how it happened, from my perspective it's a security vulnerability if there's anything the server can send that will wipe data from the client. So the spec doesn't seem reasonable to me. I want to use a client that keeps my data safe from server malfunctions, whether accidental or intentional.

kragen 5y ago

Thanks! Yeah, it was an extremely rude awakening, and I've lost months of logs of conversations that I thought were securely in my possession. From my point of view, if there's anything the server that can do that will cause my client to delete data, that's a security hole in the client that should be fixed—I want to run a client that is a user agent, serving my interests as a user, not a server agent, acting on behalf of the server. It seems like the authors of the spec had the opposite perspective on this? Of course a DHTML web page is a server agent; it's just a convenient way for the server to get better responsiveness and resilience against network failures. It relies on the server completely for its integrity—the server can inject whatever code it wants. So the server-agent mindset is understandable for a team that started out developing a DHTML web page. But a phone or desktop app doesn't have to work that way; it can protect the user from malicious servers. And, I think, it should.

pkulak 5y ago

Why would a server failure 401? The spec seems reasonable to me. This looks like some kind of proxy setup mistake, maybe?

kragen 5y ago
I haven't asked A., but as I said, I suspect she was reinstalling the server from scratch, and hadn't yet gotten to the part where she restored the database from backups. So all login attempts were failing. I didn't yet realize there was a server problem, myself. I thought Element on my phone was failing and that I was misremembering the password when I tried to log in from the browser. Generally, though, regardless of how it happened, from my perspective it's a security vulnerability if there's anything the server can send that will wipe data from the client. So the spec doesn't seem reasonable to me. I want to use a client that keeps my data safe from server malfunctions, whether accidental or intentional.