element-hq / element-hq/element-ios

Cryptographically safe eventDeviceInfo

Open
#7,780 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Swift
Stars
1.8k
Forks
544
PR merge metrics
PR metrics pending

Description

The `MXCrypto.eventDeviceInfo` method, used to display several encryption decorations on the timeline, uses unsafe / plaintext fields of `MXEvent` to fetch a relevant device. These are easily spoofable by the homeserver, see [code](https://github.com/matrix-org/matrix-ios-sdk/blob/develop/MatrixSDK/Crypto/MXCryptoV2.swift#L293-L301)

A better approach is to use a `sender_key` that should match any of our previously created sessions with this device. To access this data / fetch device by its `sender_key`, relevant changes need to be made in rust crypto

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.