Skip to content

MSC4287: Sharing key backup preference between clients#4287

Merged
turt2live merged 23 commits intomainfrom
andybalaam/shared-key-backup-preference
Mar 24, 2026
Merged

MSC4287: Sharing key backup preference between clients#4287
turt2live merged 23 commits intomainfrom
andybalaam/shared-key-backup-preference

Conversation

@andybalaam
Copy link
Copy Markdown
Member

@andybalaam andybalaam commented May 8, 2025 •
edited by turt2live
Loading

Rendered

Implementations:

I am employed by Element and a Matrix community member. This proposal was written and published with my Element client developer hat on.

SCT Stuff:

MSC checklist

FCP tickyboxes

@andybalaam andybalaam changed the title Sharing key backup preference between clients MSC4287: Sharing key backup preference between clients May 8, 2025
@andybalaam andybalaam marked this pull request as ready for review May 8, 2025 15:23
@andybalaam andybalaam mentioned this pull request May 9, 2025
Merged
@turt2live turt2live added e2e proposal A matrix spec change proposal client-server Client-Server API kind:maintenance MSC which clarifies/updates existing spec needs-implementation This MSC does not have a qualifying implementation for the SCT to review. The MSC cannot enter FCP. labels May 12, 2025
turt2live
turt2live reviewed May 12, 2025
View reviewed changes
Comment thread proposals/4287-shared-key-backup-preference.md
Half-Shot
Half-Shot reviewed May 12, 2025
View reviewed changes
Comment thread proposals/4287-shared-key-backup-preference.md
richvdh
richvdh reviewed May 13, 2025
View reviewed changes
Comment thread proposals/4287-shared-key-backup-preference.md Outdated
richvdh
richvdh reviewed May 13, 2025
View reviewed changes
Comment thread proposals/4287-shared-key-backup-preference.md Outdated
Comment thread proposals/4287-shared-key-backup-preference.md Outdated
Comment thread proposals/4287-shared-key-backup-preference.md Outdated
Comment thread proposals/4287-shared-key-backup-preference.md
Comment thread proposals/4287-shared-key-backup-preference.md Outdated
Comment thread proposals/4287-shared-key-backup-preference.md
@andybalaam andybalaam mentioned this pull request Jun 2, 2025
Closed
@andybalaam andybalaam mentioned this pull request Jun 16, 2025
Merged
@uhoreg uhoreg mentioned this pull request Dec 11, 2025
Open
@richvdh richvdh removed the needs-implementation This MSC does not have a qualifying implementation for the SCT to review. The MSC cannot enter FCP. label Jan 21, 2026
@richvdh richvdh self-requested a review January 21, 2026 10:48
richvdh
richvdh reviewed Jan 21, 2026
View reviewed changes
Comment thread proposals/4287-shared-key-backup-preference.md Outdated
Comment thread proposals/4287-shared-key-backup-preference.md Outdated
Comment thread proposals/4287-shared-key-backup-preference.md Outdated
Comment thread proposals/4287-shared-key-backup-preference.md
Comment thread proposals/4287-shared-key-backup-preference.md
andybalaam and others added 2 commits January 22, 2026 16:08
@andybalaam @richvdh
Clarify that this only applies to clients that support key backup
b43f9c2 
Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com>
@andybalaam @richvdh
Fix extra JSON in account_data response.
5bc4d87 
Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com>
richvdh
richvdh reviewed Mar 11, 2026
View reviewed changes
Comment thread proposals/4287-shared-key-backup-preference.md Outdated
ara4n
ara4n reviewed Mar 17, 2026
View reviewed changes
Comment thread proposals/4287-shared-key-backup-preference.md

## Security considerations

Unencrypted account data is under the control of the server, so a malicious
Copy link
Copy Markdown
Member

@ara4n ara4n Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Heads up that I tripped over this fairly badly while reviewing; my thought process was: "autoenabling backup sounds scary; warning users sounds even scarier - what would the warning even say?". @tulir pointed out however that in practice current clients enable backup automatically at login - so in practice this doesn't significantly change the attack surface.

Instead, paranoid clients which let the user opt out of backup should warn the user when they are enabling backup whatever the scenario - including at login.

Unsure if this needs to be written up on the MSC, but am commenting it here so I have something to refer back to in future.

@mscbot
Copy link
Copy Markdown
Collaborator

mscbot commented Mar 17, 2026

🔔 This is now entering its final comment period, as per the review above. 🔔

@mscbot mscbot added final-comment-period This MSC has entered a final comment period in interest to approval, postpone, or delete in 5 days. and removed proposed-final-comment-period Currently awaiting signoff of a majority of team members in order to enter the final comment period. labels Mar 17, 2026
@turt2live turt2live removed the 00-weekly-pings Tracking for weekly pings in the SCT office. 00 to make it first in the labels list. label Mar 17, 2026
@turt2live turt2live moved this from Ready for FCP ticks to In FCP in Spec Core Team Workflow Mar 17, 2026
@mscbot
Copy link
Copy Markdown
Collaborator

mscbot commented Mar 22, 2026

The final comment period, with a disposition to merge, as per the review above, is now complete.

@mscbot mscbot added finished-final-comment-period and removed disposition-merge final-comment-period This MSC has entered a final comment period in interest to approval, postpone, or delete in 5 days. labels Mar 22, 2026
Johennes
Johennes reviewed Mar 23, 2026
View reviewed changes
Comment thread proposals/4287-shared-key-backup-preference.md Outdated
Johennes
Johennes reviewed Mar 23, 2026
View reviewed changes
Comment thread proposals/4287-shared-key-backup-preference.md
@turt2live turt2live merged commit 628d53e into main Mar 24, 2026
1 check passed
@turt2live turt2live added spec-pr-missing Proposal has been implemented and is being used in the wild but hasn't yet been added to the spec and removed finished-final-comment-period labels Mar 24, 2026
@turt2live turt2live moved this from In FCP to Requires spec writing in Spec Core Team Workflow Mar 24, 2026
@andybalaam
Copy link
Copy Markdown
Member Author

andybalaam commented Apr 9, 2026

Introducing stable identifiers:

@andybalaam andybalaam mentioned this pull request Apr 10, 2026
Open
3 tasks
@andybalaam
Copy link
Copy Markdown
Member Author

andybalaam commented Apr 10, 2026

Spec PR: matrix-org/matrix-spec#2354

@turt2live turt2live added spec-pr-in-review A proposal which has been PR'd against the spec and is in review and removed spec-pr-missing Proposal has been implemented and is being used in the wild but hasn't yet been added to the spec labels Apr 10, 2026
@turt2live turt2live moved this from Requires spec writing to Requires spec PR review in Spec Core Team Workflow Apr 10, 2026
This was referenced Apr 16, 2026
Draft
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@clokep clokep clokep left review comments

@uhoreg uhoreg uhoreg left review comments

@turt2live turt2live turt2live approved these changes

@ara4n ara4n ara4n left review comments

@richvdh richvdh richvdh left review comments

@Half-Shot Half-Shot Half-Shot left review comments

+1 more reviewer

@Johennes Johennes Johennes left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

client-server Client-Server API e2e kind:maintenance MSC which clarifies/updates existing spec proposal A matrix spec change proposal spec-pr-in-review A proposal which has been PR'd against the spec and is in review

Projects

Spec Core Team Workflow
Status: Requires spec PR review

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

10 participants

@andybalaam @richvdh @mscbot @clokep @tulir @turt2live @uhoreg @Johennes @ara4n @Half-Shot