4 ms·
> trick vulnerable clients into disclosing encryption keys for messages previously sent by that client to user accounts later compromised by an attacker. Doesn
by fouc 5y ago
> trick vulnerable clients into disclosing encryption keys for messages previously sent by that client to user accounts later compromised by an attacker.
Doesn't the fact there's some kind of mechanism or expectation of sending encryption keys willy nilly imply a flaw with the protocol perhaps?
- pkulak 5y ago> willy nilly It's not though. The fix is to cryptographically verify requesting clients before sending.
- aidenn0 5y agoThey address this in the last two paragraphs of the article.
- Joe_Cool 5y agoIf "send key to all members of channel x" is enabled it would be good if that would work. You can set it to "only other clients and people I have personally verified" but that is quite cumbersome for big channels that just don't want clear text.