element-hq / element-hq/element-meta
Support TOFU on invalid TLS certs
Open
- Dominant language
- No language data
- Stars
- 112
- Forks
- 26
- Avg merge
- 6h 6m
- Merged PRs (30d)
- 4
Description
If folks run a homeserver with an invalid certificate, much like a browser, we should respect HSTS or otherwise prompt the user if they want to TOFU the invalid cert.
See https://news.ycombinator.com/item?id=37616939
Contributor guide
No contributing guide indexed for this repository
Research direction
No implementation files, tests, or client entry points are named. Start by reading the issue and the linked Hacker News discussion to clarify the HSTS and TOFU requirements, then identify the affected Element clients and their certificate-handling tests. Done should include an agreed user flow for invalid certificates that respects HSTS.
Written by the indexing model from the issue text.
Assessment
- Domain
- networking, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100