m.room.encryption state event missing

[hex-m]

Steps to reproduce

This only happened to me with one room, so I don't know how to reproduce.

1. encrypted 1-on-1 chat created with element-desktop works as usual
2. sending message into that room from element-android
3. element-desktop warns that the message is Unencrypted

I've sent messages to that room using element-android on 2021-01-05 (probably with the latest version from f-droid at that time) without experiencing this problem.

Outcome

What did you expect?

Element-Android should recognize that the room has encryption enabled and send encrypted messages.

What happened instead?

Element-Android does not recognize the room as encrypted. The settings screen of the room tells me "Messages here are not end-to-end encrypted".

Checking in the dev tools, there is no m.room.encryption in the "State Events" view. Checking with Element-Desktop, the state event is shown.

Your phone model

Fairphone 3

Operating system version

Android 10

Application version and app store

1.3.15 from f-droid

Homeserver

Synapse 1.47.1

Will you send logs?

No

[trev268]

I would like to add that this issue happened to me after upgrading to the f-droid version 1.3.15. On a 1-on-1 encrypted chat I woke up to the room randomly being decrypted on mobile. I was unable to re-enable encryption and was forced to recreate the room.

Phone Model: Google Pixel 5
Phone OS: GrapheneOS
Homeserver: Unsure

I would also like to add that I wouldn't have known that the room was decrypted because unlike desktop the mobile version doesn't show a red icon when encryption has been turned off, thankfully my friend only uses desktop so he warned me.

[BillCarsonFr]

Did you sent some rageshakes?

[hex-m]

Sending them now. I mentioned the issue in the comment field.

[BillCarsonFr]

Thx @hex-m

[BillCarsonFr]

:/ Logs aren't going as far as 2021-01-05

[trev268]

Did you sent some rageshakes?

Is it possible to send rageshakes after you have left the room on mobile?

[BillCarsonFr]

Did you sent some rageshakes?

Is it possible to send rageshakes after you have left the room on mobile?

Yes

[hex-m]

:/ Logs aren't going as far as 2021-01-05

I scrolled back in the conversation and could see, that the old messages are shown as encrypted and are then decrypted. Send a second rageshake after that so hopefully you get something useful out of that.

[BillCarsonFr]

Other occurence of broken state https://github.com/matrix-org/element-android-rageshakes/issues/32930

[yajo]

This happens to me too. I send unencrypted messages to some E2EE rooms from element-android, while not in element-web. I have another colleague with the same problem. All devices are verified.

I also noticed that on a couple of rooms, the Android client couldn't display the room name. I had to change it twice in desktop client to fix it.

[capocasa]

This bug just resulted in me sending out unencrypted messages in a chat I thought was encrypted. Those messages were harmless, but I believe that some kind of safeguard needs to be added to ensure a bug like this causes no messages to be sent, not unencrypted ones.

Edit: I have just received word from @t3chguy that the Desktop and Web clients already have such a safeguard. That the Android client does degrades the security of the entire app ecosystem. Are all the clients not held to equal security standards?

[BillCarsonFr]

This bug just resulted in me sending out unencrypted messages in a chat I thought was encrypted. Those messages were harmless, but I believe that some kind of safeguard needs to be added to ensure a bug like this causes no messages to be sent, not unencrypted ones.

Edit: I have just received word from @t3chguy that the Desktop and Web clients already have such a safeguard. That the Android client does degrades the security of the entire app ecosystem. Are all the clients not held to equal security standards?

Thx for the report,
Android has a similar safeguard, but implemented differently and in this case it didn't resist to the issue (a local wipe ou of states). The root issue is found and new release is cooking.

But yes currently the 3 platforms are using 3 different SDKs, that are all a bit different and evolve at different pace.
That's why we are moving towards having a single SDK cross platform (rust sdk).

Additional safeguard and defensive coding are beeing added meanwhile and will come in next releases

[bmarty]

Fixed in Element Android 1.3.18 (#5137)

[hex-m]

I confirm that the issue is gone after the update. Thanks for the clear communication and for the fast fix! <3