chatmail / chatmail/core

When v2.22.0 is sufficiently rolled, out, make rules for verification stricter

Open
#7,340 11 comments 0 reactions 0 assignees View on GitHub
discussion
Dominant language
Rust
Stars
929
Forks
143
Avg merge
1d 20h
Merged PRs (30d)
53

Description

When most people have v2.22.0 (i.e. around December/January), we want to have stricter rules for who counts as verified:

- Revert https://github.com/chatmail/core/pull/7336
- Unresolved question: Do we also want to reset direct verifications, or only indirect verifications?
- Direct verifications are generally not as broken as indirect verifications
- If we reset all direct verifications, maybe some people will complain
- But, verifications now have a stronger meaning, because verifications expire.
- Revert https://github.com/chatmail/core/pull/7349 (commit https://github.com/chatmail/core/commit/8b4c718b6b1076678dd77a7eb0426cff25077e91)
- _Possibly:_ Don't verify people who joined a group (on Alice's side), for two reasons:
- People often create a link and paste it into a chat for others to join
- Even if the group creator has others scan a QR code, they often won't remember who was who
This can be easily implemented by creating AUTH tokens for group-invite-codes as immediately expired.
If we don't reset all verifications now, then this can be done in a few months rather than now.
OTOH, it's nice to have an "along-the-way" verification.
- _Possibly_: Don't verify the inviter when joining a group (on Bob's side)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.