You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The react-sdk generates an AES key random string and passes it into the js-sdk as pickleKey. We should use that instead.
(The advantage of this is that the random string is itself encrypted with an AES key, which is generated with extractable set to false, which makes it more difficult to steal someone's entire crypto store via an XSS vulnerability or similar.)
The text was updated successfully, but these errors were encountered:
Currently we hardcode "test pass" as the encryption passphrase for the IndexedDB data (see https://github.com/matrix-org/matrix-js-sdk/blob/develop/src/rust-crypto/index.ts#L39-L40).
The react-sdk generates an
AES keyrandom string and passes it into the js-sdk aspickleKey
. We should use that instead.(The advantage of this is that the random string is itself encrypted with an AES key, which is generated with
extractable
set tofalse
, which makes it more difficult to steal someone's entire crypto store via an XSS vulnerability or similar.)The text was updated successfully, but these errors were encountered: