chatmail / chatmail/core

Profile transferred to second device message should go to all devices

Open
#7,968 2 comments 3 reactions 0 assignees View on GitHub
discussion enhancement
Dominant language
Rust
Stars
929
Forks
143
Avg merge
1d 20h
Merged PRs (30d)
53

Description

When transfering a profile to another device the "Profile transferred" message only goes into the local device messages chat of the transferring device. It would improve security if that message goes to all devices imo.

In case someone has access to one of your devices just for a short time (or finds other ways to trick you), adds another second device and deletes the "Profile transferred" message on that device. From then you would never know that there is an additional device listening to all your chats.

Yes - if someone gets access to your device he just could make a backup and transfer it to anywhere but the add second device is very fast and convenient for that kind of attack.

And a fix is easy to implement, just send the success message to SELF chat instead of device messages in https://github.com/chatmail/core/blob/a95bf778687ce5770c753abbb30fb9bbf2d53c12/src/imex/transfer.rs#L212

Edit: the same applies for restore from backup

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.