Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

We're not slipping in our own DM key into recps anymore, keep an eye out for breakage #101

Open
Tracked by #90
Powersource opened this issue Oct 24, 2023 · 2 comments

Comments

@Powersource
Copy link
Contributor

In the db2 PR #96 we're removing envelope.js in favor of ssb-box2. envelope.js had this hack that tries to put out own dm key into all the content.recps. Removing that should be fine but let's keep an eye out in case something was depending on that.

ssb-tribes/envelope.js

Lines 37 to 41 in 134064b

if (process.env.NODE_ENV !== 'test') {
// slip my own_key into a slot if there's space
// we disable in tests because it makes checking unboxing really hard!
if (recps.indexOf(state.keys.id) < 0) recps.push(state.keys.id)
}

This was referenced Oct 24, 2023
@mixmix
Copy link
Member

mixmix commented Nov 16, 2023

yeah I can't remember the reason for this... but I don't like how sneaky it is.

I think the justification was that with box2 it's impossible to send one-way messages (unlike box1), as you are always doing a diffie-hellman cross between your key and another persons.... I'm fuzzy on this though

@mixmix
Copy link
Member

mixmix commented Apr 9, 2024

I think this is fine. We will be doing thorough testing, so will watch for anything odd.

We need to revisit key backup in future...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants