No passwords or security measure for deleting account on desktop client.
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 9.2k
- Forks
- 1.3k
- Avg merge
- 12h 58m
- Merged PRs (30d)
- 56
Description
I've mentioned this before, but it seems it got unnoticed.
In the (windows) client app, you can "delete" your entire account, under settings, without it asking for your password or anything else. Now, for obvious reasons I haven't gone past clicking the delete button and it asking me if I'm sure, so there's no way to know if something else happens after, but it makes it seems like once you click that "Yes I'm sure" button, it knows you're sure and deletes it.
Can someone confirm this is the case or if not, advise on what security measures there are for people who need to have Keybase running all the time and wants protection against an "evil" co-worker who happens to see your unattended computer for 2 seconds?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the account-deletion flow in the Windows client from Settings, including the confirmation step. Verify whether any password or other security measure is required after clicking the confirmation button, and document the observed behavior and expected protection for an unattended computer.
Written by the indexing model from the issue text.
Assessment
- Domain
- desktop, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100