Matrix: the account's email and phone cannot be seen or changed #223

Closed
opened 2026-09-13 11:59:36 -04:00 by Salastil · 1 comment
Owner

No 3PID support: /account/3pid is never called. So an address cannot be added, removed, or listed, and password recovery by email cannot be set up from here.

Adjacent and also missing: third-party invites (m.room.third_party_invite), which is how somebody is invited to a room by email address before they have an account.

No 3PID support: `/account/3pid` is never called. So an address cannot be added, removed, or listed, and password recovery by email cannot be set up from here. Adjacent and also missing: third-party invites (`m.room.third_party_invite`), which is how somebody is invited to a room by email address before they have an account.
Salastil added the featurelow priority labels 2026-09-13 11:59:36 -04:00
Author
Owner

Finished.

Both halves are user-interactive-auth gated and reuse the password dance signing another device out already does.

Adding an email is the two steps it really is: the homeserver mails a link, and the account changes only once somebody says they have followed it. A single call would have to either lie about what happened or block on an inbox. The homeserver sends the mail itself — binding to a public identity server is a separate act nobody has asked for.

Adding a phone is not offered: it needs an identity server to send the message and hold the binding, and this client has none. An existing one is still listed and can still be removed, which is the half that matters for taking an address off. Third-party room invites are the same gap and are left with it.

The live probe found this account carrying no addresses at all — so there is currently no way to recover it, which the empty state now says outright.

d612fcc

Finished. Both halves are user-interactive-auth gated and reuse the password dance signing another device out already does. Adding an email is the two steps it really is: the homeserver mails a link, and the account changes only once somebody says they have followed it. A single call would have to either lie about what happened or block on an inbox. The homeserver sends the mail itself — binding to a public identity server is a separate act nobody has asked for. Adding a **phone** is not offered: it needs an identity server to send the message and hold the binding, and this client has none. An existing one is still listed and can still be removed, which is the half that matters for taking an address off. Third-party room invites are the same gap and are left with it. The live probe found this account carrying **no addresses at all** — so there is currently no way to recover it, which the empty state now says outright. [d612fcc](https://git.salastil.com/Salastil/moho/commit/d612fcc)
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Salastil/moho#223