different devices with the same curve25519 key confuse the olm layer

[richvdh]

We assume that no two devices will ever share a curve25519 key, which means that we will use the same OlmSession for two devices if they do, leading to mysterious failiures to decrypt. We can do better than this

[ara4n]

presumably this is quite likely if people clone their devices by restoring from backup etc?

[richvdh]

if you restore from backup, you'll probably end up with the same deviceid.

It hits people who use the js-sdk with node-localstorage, because the js-sdk persists the olm keys to localstorage, but not the device id/accesstoken/etc; so you end up reusing the old keys with a new deviceid.

[ara4n]

from a riot perspective this really isn't that urgent, given we don't use node-localstorage.

[go2null]

Another use case where this occurs - overwrite an F-Droid installation with a Playstore install.
(I know, I know, this is really out there, but just wanted to expand the problem domain.)