Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cryptographically safe eventDeviceInfo #7780

Open
richvdh opened this issue Apr 26, 2024 · 0 comments
Open

Cryptographically safe eventDeviceInfo #7780

richvdh opened this issue Apr 26, 2024 · 0 comments

Comments

@richvdh
Copy link
Member

richvdh commented Apr 26, 2024

The MXCrypto.eventDeviceInfo method, used to display several encryption decorations on the timeline, uses unsafe / plaintext fields of MXEvent to fetch a relevant device. These are easily spoofable by the homeserver, see code

A better approach is to use a sender_key that should match any of our previously created sessions with this device. To access this data / fetch device by its sender_key, relevant changes need to be made in rust crypto

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant