element-hq / element-hq/element-ios
Cryptographically safe eventDeviceInfo
Open
- Dominant language
- Swift
- Stars
- 1.8k
- Forks
- 544
- PR merge metrics
- PR metrics pending
Description
The `MXCrypto.eventDeviceInfo` method, used to display several encryption decorations on the timeline, uses unsafe / plaintext fields of `MXEvent` to fetch a relevant device. These are easily spoofable by the homeserver, see [code](https://github.com/matrix-org/matrix-ios-sdk/blob/develop/MatrixSDK/Crypto/MXCryptoV2.swift#L293-L301)
A better approach is to use a `sender_key` that should match any of our previously created sessions with this device. To access this data / fetch device by its `sender_key`, relevant changes need to be made in rust crypto
Contributor guide
Assessment
This issue has not been assessed yet.