element-hq / element-hq/element-meta
Sticker images aren't encrypted (but the event is)
Open
A-E2EE
A-Stickers
P2
S-Minor
Security
T-Defect
- Dominant language
- No language data
- Stars
- 112
- Forks
- 25
- Avg merge
- 6h 6m
- Merged PRs (30d)
- 4
Description
### Description
This poses a risk of the homeserver/media repo being able to correlate how often a sticker is used, although it's not directly related to the room itself. Some concerns were raised in the #megolm test room about the image itself not being encrypted.
To be absolutely clear: the event is encrypted, and must be decrypted to discover the sticker image. The image URL is not an encrypted version of the sticker, however.
### Version information
- **Platform**: web (in-browser)
- **Browser**: Chrome 66
- **OS**: Windows 10
- **URL**: riot.im/develop
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.