RocketChat / RocketChat/Rocket.Chat
It should be very obvious when E2EE is NOT enabled for a Direct Message
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description:
I've only now just realized after years(!) of being an occasional rocket chat user, that despite my assumption that all direct messages used the E2EE encryption, none of them did. This seems like a sort of UI oversight, and I would suggest that if a user account has E2EE available with an end-to-end-encryption password set, that whenever that user looks at any direct message chat there should be some clear warning if that chat is currently not using that encryption.
Also, opening a new DM should probably automatically use E2EE, unless I explicitly opt out. However, that seems like a separate concern I guess.
Steps to reproduce:
- Use Rocket Chat for a while with E2EE password set
- Realize you're not actually using E2EE for direct messages even though you thought you were
Expected behavior:
There should be a big warning if an E2EE password is set but a direct one-to-one chat doesn't use it.
Actual behavior:
Sadly, there doesn't seem to be a good warning of any kind:
Server Setup Information:
- Version of Rocket.Chat Server: I don't know, some variant of "Rocket.Chat Community". I couldn't find any section in the preferences that shows the server version.
- License Type:
- Number of Users:
- Operating System:
- Deployment Method:
- Number of Running Instances:
- DB Replicaset Oplog:
- NodeJS Version:
- MongoDB Version:
Client Setup Information
- Desktop App or Browser Version: Librewolf 152.0.4-1
- Operating System: Linux x64
Additional context
Relevant logs:
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files or tests are named. Start by reproducing the behavior in a direct one-to-one message with an E2EE password set, then trace the direct-message UI's encryption state; done means a clear warning appears when E2EE is unavailable or unused.
Written by the indexing model from the issue text.
Assessment
- Domain
- frontend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100