4 ms·

I use the strict cookie policy on firefox, and set cookies to be deleted at shutdown. I just save credentials and login to platforms each time. I joined the mo

by jokoon 10mo ago

I use the strict cookie policy on firefox, and set cookies to be deleted at shutdown. I just save credentials and login to platforms each time. I joined the mozilla matrix, and ironically, this caused the auth system to completely break down for some reason since I would log in each time. It suggested to reset the whatever login data cookie thing because it did not want to trust me anymore, displaying red warning or whatever. I asked around, and apparently they disagreed about that strict cookie policy, which felt quite ironic coming from the mozilla community.

aprilnya 10mo ago
Yes, deleting your encryption keys every time you close the end to end encrypted chat app is definitely a great idea
- dxdm 10mo ago
  I know nothing about any of this and I am surprised to learn that something that is apparently considered to be permanent is stored in something as ephemeral as a browser cookie, and then causes problems if deleted. At least this is how I understand the exchange above.
  - necovek 10mo ago
    Any web application really has access only to "ephemeral" storage like cookies or localStorage when used in this manner (you could be cleaning your localStorage for every session too). Switching to localStorage would help things, but until they do, you can avoid the known failure case for Element Web by not doing that. Obviously though, they need to figure out a way to reestablish encryption when the keys are gone, as long as you are willing to accept no access to history, or keeping keys encrypted server side.
0x1ch 10mo ago
As the other guy pointed out, you would 100% experience the same issues if Signal was a web app. You're deleting your encryption keys. They have to be stored somewhere. You want private keys on the public server?
- cvwright 10mo ago
  Don’t blame the user - blame Matrix for designing the system like this. > They have to be stored somewhere. You want private keys on the public server? Yes. Encrypted. The feature is called “dehydrated devices” and the Matrix team has been working on it for quite a while now.
  - petre 10mo ago
    With other private keys stored somewhere. You're just kicking the can down the road.

by jokoon 10mo ago

aprilnya 10mo ago

Yes, deleting your encryption keys every time you close the end to end encrypted chat app is definitely a great idea

dxdm 10mo ago
I know nothing about any of this and I am surprised to learn that something that is apparently considered to be permanent is stored in something as ephemeral as a browser cookie, and then causes problems if deleted. At least this is how I understand the exchange above.
- necovek 10mo ago
  Any web application really has access only to "ephemeral" storage like cookies or localStorage when used in this manner (you could be cleaning your localStorage for every session too). Switching to localStorage would help things, but until they do, you can avoid the known failure case for Element Web by not doing that. Obviously though, they need to figure out a way to reestablish encryption when the keys are gone, as long as you are willing to accept no access to history, or keeping keys encrypted server side.

0x1ch 10mo ago

As the other guy pointed out, you would 100% experience the same issues if Signal was a web app. You're deleting your encryption keys. They have to be stored somewhere. You want private keys on the public server?

cvwright 10mo ago
Don’t blame the user - blame Matrix for designing the system like this. > They have to be stored somewhere. You want private keys on the public server? Yes. Encrypted. The feature is called “dehydrated devices” and the Matrix team has been working on it for quite a while now.
- petre 10mo ago
  With other private keys stored somewhere. You're just kicking the can down the road.