Profile transferred to second device message should go to all devices
- Dominant language
- Rust
- Stars
- 929
- Forks
- 143
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 53
Description
When transfering a profile to another device the "Profile transferred" message only goes into the local device messages chat of the transferring device. It would improve security if that message goes to all devices imo.
In case someone has access to one of your devices just for a short time (or finds other ways to trick you), adds another second device and deletes the "Profile transferred" message on that device. From then you would never know that there is an additional device listening to all your chats.
Yes - if someone gets access to your device he just could make a backup and transfer it to anywhere but the add second device is very fast and convenient for that kind of attack.
And a fix is easy to implement, just send the success message to SELF chat instead of device messages in https://github.com/chatmail/core/blob/a95bf778687ce5770c753abbb30fb9bbf2d53c12/src/imex/transfer.rs#L212
Edit: the same applies for restore from backup
Contributor guide
Assessment
This issue has not been assessed yet.