fix: Don't reverify contacts by SELF on receipt of a message from another device #7138
Conversation
This comment was marked as resolved.
This comment was marked as resolved.
iequidoo
force-pushed
the
iequidoo/dont-reverify-by-self
branch
2 times, most recently
from
39d5c5c to
19b5126
Compare
|
I've checked that logically this doesn't conflict with #7116, so can be merged independently. Not adding tests for the two last fixes yet because there may be other ideas on how to solve the problems described. |
It needs to be based on top of main for this. I also commented in #7116 (comment) |
src/contact.rs
Outdated
| if verifier_verifier_id == verifier_id { | ||
| // Avoid introducing incorrect reverse chains: if the verifier itself has an | ||
| // unknown verifier, it may be `contact_id` actually (directly or indirectly) on | ||
| // the other device. |
There was a problem hiding this comment.
You don't even need the other device for this except for getting "verified by unknown contact" in the first place. If you have Alice and Bob verified by unknown contact, then they start chatting in some group and claim that each other is verified (via Chat-Verified currently, later with _verified attribute of Autocrypt-Gossip), you will get a loop with Alice and Bob having each other as verifier.
There was a problem hiding this comment.
You don't even need the other device for this except for getting "verified by unknown contact" in the first place.
This is what i meant exactly. Added this to the comment to make it more clear.
As for "verifier loops", they're already not possible before this commit. Only "reverse chains" are possible on different devices.
…ther device Also verify not yet verified contacts w/o setting a verifier for them (in the db it's stored as `verifier_id=id` though) because we don't know who verified them for another device.
If this happens, mark the contact as verified by an unknown contact instead. This avoids introducing incorrect reverse chains: if the verifier itself has an unknown verifier, it may be `contact_id` actually (directly or indirectly) on the other device (which is needed for getting "verified by unknown contact" in the first place).
iequidoo
force-pushed
the
iequidoo/dont-reverify-by-self
branch
from
d52fd61 to
6ea63c7
Compare
…verifier Now that the previous commit avoids creating incorrect reverse verification chains, we can do this. Sure, existing users' dbs aready have verification chains ending with "unknown" roots, but at least for new users updating `verifier_id` to a known verifier makes sense.
iequidoo
force-pushed
the
iequidoo/dont-reverify-by-self
branch
from
6ea63c7 to
c10965c
Compare
Going to do this in a follow-up PR. |
No description provided.