Labels Milestones

New Issue

Blind Trust Before Verification - Allow user to verify manually contact device fingerprint #640

Open

opened 3 months ago by andypl · 2 comments

andypl commented 3 months ago

General information

• Version: 3.1.0 beta (2021-09-17)-playstore
• Device: Pixel 5
• Android Version: Android 12 (stock)
• Server name: own domain on conversations.im
• Pix-Art Messenger source: PlayStore Beta Channel,

Blabber has an Blind Trust Before Verification feature (BTBV).
How it works? Its described here https://gultsch.de/trust.html, TLDR version:

Automatically trust all new devices of contacts that haven’t been verified before, and prompt for manual confirmation each time a verified contact adds a new device.

This is working OK, but in my opinion verification of device fingerprints are not good implemented right now. Why?

Right now we have an only one option to verifing a contact device fingerprint - by scanning an QR Code. It works only in some cases and this create problems.

For example:

1. If we text with a friend that is in another country, we are unable to meet him in place and scann qr code. We can send him in trusted channel (by email using openPGP - verified keys) screenshot of our qr code, but it genereate another problem. How he can scan it, if he have only one smartphone? QR Code scanner use back camera to scan it, so we must have a printed version of this code, or use another device to display it. Its stupid.
2. If friend client can't generate this qrcode, we can't verify it.
3. What if friend use an desktop client on a notebook or desktop computer? We must visit him, to veryfi this qrcode...it's stupid.
4. Mix all of 1-3 scenario.

So how we can resolve this situations? I think that Blabber should be able to manually set device fingerprint status to veryfied.

My proposition is to replace button "Scan QR Code" with Verify contact fingerprint, when we touch this button a new view will appear and we have another two buttons: B1: Verify it by qrcode, B2: Verify it manually.
B1 will behave as existing Scan QR Code, and "Verify it manually" button will set Verified status on that device fingerprint.

#### General information * **Version:** 3.1.0 beta (2021-09-17)-playstore * **Device:** Pixel 5 * **Android Version:** Android 12 (stock) * **Server name:** own domain on conversations.im * **Pix-Art Messenger source:** PlayStore Beta Channel, Blabber has an Blind Trust Before Verification feature (BTBV). How it works? Its described here https://gultsch.de/trust.html, TLDR version: > Automatically trust all new devices of contacts that haven’t been verified before, and prompt for manual confirmation each time a verified contact adds a new device. This is working OK, but in my opinion verification of device fingerprints are not good implemented right now. Why? Right now we have an only one option to verifing a contact device fingerprint - by scanning an QR Code. It works only in some cases and this create problems. For example: 1. If we text with a friend that is in another country, we are unable to meet him in place and scann qr code. We can send him in trusted channel (by email using openPGP - verified keys) screenshot of our qr code, but it genereate another problem. How he can scan it, if he have only one smartphone? QR Code scanner use back camera to scan it, so we must have a printed version of this code, or use another device to display it. Its stupid. 2. If friend client can't generate this qrcode, we can't verify it. 3. What if friend use an desktop client on a notebook or desktop computer? We must visit him, to veryfi this qrcode...it's stupid. 4. Mix all of 1-3 scenario. So how we can resolve this situations? I think that Blabber should be able to manually set device fingerprint status to veryfied. My proposition is to replace button "Scan QR Code" with Verify contact fingerprint, when we touch this button a new view will appear and we have another two buttons: B1: Verify it by qrcode, B2: Verify it manually. B1 will behave as existing Scan QR Code, and "Verify it manually" button will set Verified status on that device fingerprint.

toxi referenced this issue 3 months ago

OMEMO and BTBV: Inform user on key / fingerprint change #641

toxi commented 3 months ago

should be closed. this is no issue.

should be closed. this is no issue.

andypl commented 3 months ago

Poster

should be closed. this is no issue.

Of course it's an issue. Blabber user can't set device fingerprint status to verify in another way that scanning their qr code.

Dino or Gajm allow verifying fingerprint without scan qr code.

> should be closed. this is no issue. Of course it's an issue. Blabber user can't set device fingerprint status to verify in another way that scanning their qr code. Dino or Gajm allow verifying fingerprint without scan qr code.

andypl referenced this issue 3 months ago

OMEMO and BTBV: Inform user on key / fingerprint change #641

Echolon added the

Enhancement

OMEMO/Encryption

labels 2 months ago

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

master

old_master

0.1

0.1-rc1

0.1-rc2

0.1.1

0.1.2

0.1.3

0.10

0.1rc3

0.1rc4

0.1rc5

0.2

0.2-alpha

0.2-beta

0.2.1

0.2.2

0.2.3

0.3

0.3-beta

0.4

0.4.1

0.5

0.5-beta

0.5.1

0.5.2

0.6

0.7

0.7.1

0.7.2

0.7.3

0.8

0.8.2

0.8.3

0.8.4

0.9

0.9.1

0.9.2

0.9.3

1.0

1.0.1

1.0.3

1.1.0

1.1.0-beta

1.10.0

1.10.1

1.11.0

1.11.0-beta.4

1.11.1

1.11.2

1.11.3

1.11.4

1.11.6

1.11.7

1.12.0

1.12.1

1.12.2

1.12.3

1.12.4

1.12.5

1.12.6

1.13.0

1.13.1

1.13.2

1.13.3

1.13.4

1.13.5

1.13.6

1.13.7

1.13.8

1.13.9

1.14.0

1.14.1

1.14.2

1.14.3

1.14.4

1.14.5

1.15.0

1.15.1

1.15.2

1.15.3

1.15.4

1.16.0

1.16.1

1.16.2

1.16.3

1.16.4

1.16.5

1.17.0

1.17.1

1.18.0

1.18.1

1.18.2

1.19.0

1.19.1

1.19.2

1.2.0

1.2.0-beta

1.20.0

1.20.1

1.20.2

1.20.3

1.21.0

1.21.1

1.21.2

1.21.3

1.22.0

1.22.1

1.3.0

1.3.1

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.4.7

1.5.0

1.5.1

1.5.2

1.6.0

1.6.10

1.6.11

1.6.12

1.6.13

1.6.3

1.6.5

1.6.7

1.6.8

1.6.9

1.6.9-beta

1.6.9-beta2

1.7.0

1.7.1

1.7.2

1.7.3

1.8.0

1.8.1

1.8.2

1.8.3

1.8.4

1.9.0

1.9.2

1.9.3

1.9.4

2.0.0

2.0.1

2.0.2

2.1.0

2.1.0.1

2.1.0.2

2.1.0.3

2.1.1

2.1.1.1-beta

2.1.1.2-beta

2.1.2

2.1.3

2.1.4

2.1.5

2.1.5.1-beta

2.2.0

2.2.0.1-beta

2.2.0.2-beta

2.2.0.3-beta

2.2.1

2.2.10.1-beta

2.2.10.2-beta

2.2.10.3-beta

2.2.10.4-beta

2.2.10.5-beta

2.2.2

2.2.3

2.2.4

2.2.4.1-beta

2.2.4.2-beta

2.2.5

2.2.6

2.2.7

2.2.8

2.2.8.1-beta

2.2.9

2.3.0

2.3.1

2.3.2

2.3.3

2.3.4

2.3.5

2.3.5.1

2.3.5.10

2.3.5.11

2.3.5.12

2.3.5.13

2.3.5.2

2.3.5.3

2.3.5.4

2.3.5.5

2.3.5.6

2.3.5.7

2.3.5.8

2.3.5.9

2.3.6

2.3.7

2.4.0

2.4.0.1

2.4.1

2.5.0

2.5.1

2.5.2

3.0.0

3.0.0.1

3.0.1

3.0.2

3.0.3

3.0.4

3.0.4.1

3.0.5

3.0.5.1

3.0.6

3.0.7

3.0.8

3.1.0

3.1.0.1

3.1.0.2

3.1.0.3

3.1.0.4

3.1.0.5

3.1.0.6

3.1.0.7

3.1.0.8

3.1.0.9

3.1.1

axolotl-alpha

Labels

Apply labels

Clear labels

Bug
Issues about bugs, error or stability Duplicate
This or a similar issue was already posted before Enhancement
Enhancement or feature request Git
Git version concerning Hardware
Issue is related to Hardware Help wanted
The developer asks everyone to help him out Invalid
The developer treats this issue as invalid or not being recognised in the development Low priority
Issue which is treated with less efforts that normal MUC
Related to MUC / group chat Need info
The developer ask for additional information. Please get back to it to help! OMEMO/Encryption
This issue is related to OMEMO or other encryptions Playstore
Playstore version concerning Priority
Issue which is treated with prioritised efforts Question
The developer or a user has raised a question UI
Related to visual appreance of the app (User Interface) Website
Issueas related to the website wontfix
This issue or request will not be fixed. Please respect XEP
This issue is related to a specific XEP

No Label Bug Duplicate Enhancement Git Hardware Help wanted Invalid Low priority MUC Need info OMEMO/Encryption Playstore Priority Question UI Website wontfix XEP

Milestone

Set milestone

Clear milestone

No items

No Milestone

Assignees

Assign users

Clear assignees

No Assignees

2 Participants

Notifications

Subscribe

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

This issue currently doesn't have any dependencies.

Write Preview

Loading…

Cancel

Save

There is no content yet.