keybase / keybase/keybase-issues

Verifying multiple messages in the same window has confusing results.

Open
#1,247 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
899
Forks
40
PR merge metrics
No merged PRs in 30d

Description

This is really not a big security issue, just a UI thing that might confuse some people.

Imagine someone is trying to verify a message [I signed](https://keybase.io/hinca). They paste it into the Verify window, and click verify. Great! It's a valid signature created by me.

```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

I'm acknowledging your testing message.
-----BEGIN PGP SIGNATURE-----
Version: Keybase OpenPGP v1.1.6
Comment: https://keybase.io/crypto

wsBcBAABCgAGBQJUfYLYAAoJEG/4KgT0o6bpi7EH/iyIAvTk1tXQFW0FGpGDf9kj
TmQN6fIFtIxlQs6MRS+Ws3Xwwj4+tfDYyjsUAZ1pLpSGuxSrnyULiXtX6L3LOsda
9byGAjO2hE3yzgRsdtCtCMCsn6PHJWKONOU5yhv0NdnpfqVPBwpbIqNLtnqMFiQq
1CuVYQqLgvT7evNMO6Z1JeNXF7EAdkxdtPGrfuZp4uZm84GcQbPXywZLjItwNPEI
MKbDuRVV9SaJfEENb0YOJdmiaQKhdmxrh5Ixkx/QzowL9qapUqv9PssBiKlz1g4g
OfQQvW30dj9fVBd01I+jHTdypg/KOblL0LpBpltM9+i6aBzuIStzqWovamzqugw=
=yvtY
-----END PGP SIGNATURE-----
```

But now I tamper with the message, so that the identical signature is no longer valid, and paste it into the same verification window. I can do this, because the field is still editable.

```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

I'm NOT acknowledging your testing message.
-----BEGIN PGP SIGNATURE-----
Version: Keybase OpenPGP v1.1.6
Comment: https://keybase.io/crypto

wsBcBAABCgAGBQJUfYLYAAoJEG/4KgT0o6bpi7EH/iyIAvTk1tXQFW0FGpGDf9kj
TmQN6fIFtIxlQs6MRS+Ws3Xwwj4+tfDYyjsUAZ1pLpSGuxSrnyULiXtX6L3LOsda
9byGAjO2hE3yzgRsdtCtCMCsn6PHJWKONOU5yhv0NdnpfqVPBwpbIqNLtnqMFiQq
1CuVYQqLgvT7evNMO6Z1JeNXF7EAdkxdtPGrfuZp4uZm84GcQbPXywZLjItwNPEI
MKbDuRVV9SaJfEENb0YOJdmiaQKhdmxrh5Ixkx/QzowL9qapUqv9PssBiKlz1g4g
OfQQvW30dj9fVBd01I+jHTdypg/KOblL0LpBpltM9+i6aBzuIStzqWovamzqugw=
=yvtY
-----END PGP SIGNATURE-----
```

The field flickers, and I would expect it to acknowledge the update and re-verify. Instead it's still claiming that the signature is valid, because keybase doesn't recognize the message as updated. I suppose re-verification on text area update, or disabling the text area after verification would take care of this.

Thanks for developing this service! I'm a fan. :+1:

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at the Verify window and reproduce the sequence of verifying one message, editing the textarea, and verifying the altered message. Confirm that the displayed result reflects the current text rather than the previous verification, or that editing is prevented after verification.

Written by the indexing model from the issue text.

Assessment

Domain
cryptography, frontend, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.