[ANDROID] ambigious verification state for https proof
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 9.2k
- Forks
- 1.3k
- Avg merge
- 12h 58m
- Merged PRs (30d)
- 56
Description
As you can see on my keybase page, my https proof is alive:
https://keybase.io/sebbe_eu
However, the android client shows the https proof as failed.
Is the Android client checking the https proof locally? (Because the server isn't reachable on its public IP adress from inside the network, inside the network it must be accessed using 192.168.x.x address).
Scanned on a couple of pages and bizarrely it shows my certificate as invalid/revoked and I checked with StartCom and it isn't revoked.... In some browsers it come up as invalid and in some browsers it come up as valid.
Its super strange - the certificate was valid when I bought it and theres no revocation at OCSP/CRL.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the Android client's HTTPS proof verification entry point and compare its behavior with the proof at https://keybase.io/sebbe_eu, including access from inside a network using a 192.168.x.x address. Check how certificate validity and revocation are evaluated through OCSP/CRL; done means the client reports the proof and certificate state consistently with the reachable server and certificate checks.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, go
- Domain
- mobile-dev, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100