keybase / keybase/client

[ANDROID] ambigious verification state for https proof

Open
#8,163 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
9.2k
Forks
1.3k
Avg merge
12h 58m
Merged PRs (30d)
56

Description

As you can see on my keybase page, my https proof is alive:
https://keybase.io/sebbe_eu

However, the android client shows the https proof as failed.

Is the Android client checking the https proof locally? (Because the server isn't reachable on its public IP adress from inside the network, inside the network it must be accessed using 192.168.x.x address).

Scanned on a couple of pages and bizarrely it shows my certificate as invalid/revoked and I checked with StartCom and it isn't revoked.... In some browsers it come up as invalid and in some browsers it come up as valid.
Its super strange - the certificate was valid when I bought it and theres no revocation at OCSP/CRL.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the Android client's HTTPS proof verification entry point and compare its behavior with the proof at https://keybase.io/sebbe_eu, including access from inside a network using a 192.168.x.x address. Check how certificate validity and revocation are evaluated through OCSP/CRL; done means the client reports the proof and certificate state consistently with the reachable server and certificate checks.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, go
Domain
mobile-dev, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.