Need to ask for current passphrase before changing passphrase or deleting account in App.
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 9.2k
- Forks
- 1.3k
- Avg merge
- 12h 58m
- Merged PRs (30d)
- 56
Description
Right now in the desktop app (windows), you can go to setting and change the passphrase without confirming the current one, same with deleting your account. I feel this is very dangerous for anyone (co-worker or friend) that passes by your computer while you're out for 2 seconds to just delete or change your account password, giving them access to everything.
Another reason is that we would like to use Keybase as a company, where we create company-client accounts (on computers that we own but rent to clients) so we can share files and chat with them in "teams". But if they can change their company accounts passwords or delete them, then we lose that account and there's no point in using keybase.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the Windows desktop app's Settings flows for changing a passphrase and deleting an account. Trace how each action currently authenticates the user, then add coverage showing that the current passphrase is required before either action can complete.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- electron, go
- Domain
- authentication, desktop, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100