Hacker News Reader

Comment by jokoon | Hacker News Reader

I use the strict cookie policy on firefox, and set cookies to be deleted at shutdown. I just save credentials and login to platforms each time.

I joined the mozilla matrix, and ironically, this caused the auth system to completely break down for some reason since I would log in each time.

It suggested to reset the whatever login data cookie thing because it did not want to trust me anymore, displaying red warning or whatever.

I asked around, and apparently they disagreed about that strict cookie policy, which felt quite ironic coming from the mozilla community.

View on HN

As the other guy pointed out, you would 100% experience the same issues if Signal was a web app. You're deleting your encryption keys. They have to be stored somewhere. You want private keys on the public server?

Don’t blame the user - blame Matrix for designing the system like this.

> They have to be stored somewhere. You want private keys on the public server?

Yes. Encrypted. The feature is called “dehydrated devices” and the Matrix team has been working on it for quite a while now.

With other private keys stored somewhere. You're just kicking the can down the road.

Yes, deleting your encryption keys every time you close the end to end encrypted chat app is definitely a great idea

I know nothing about any of this and I am surprised to learn that something that is apparently considered to be permanent is stored in something as ephemeral as a browser cookie, and then causes problems if deleted. At least this is how I understand the exchange above.

Any web application really has access only to "ephemeral" storage like cookies or localStorage when used in this manner (you could be cleaning your localStorage for every session too).

Switching to localStorage would help things, but until they do, you can avoid the known failure case for Element Web by not doing that.

Obviously though, they need to figure out a way to reestablish encryption when the keys are gone, as long as you are willing to accept no access to history, or keeping keys encrypted server side.

Reply on news.ycombinator.com