E2E: Bidirectional user verification

[lampholder]

interactive (SAS) verification

• spec
  • [x] decide what emoji to use
  • [x] decide how many bits to verify (i.e. the size of the SAS)
  • [ ] decide on any other outstanding issues
  • [ ] get the MSC accepted
• synapse: no work needed
• libolm
  • [x] SAS module (or any better name)
  • create/delete session
  • generate SAS code (as an array of numbers)
  • hash data
• js-sdk (and android-sdk, ios-sdk)
  • [x] handle sending/receiving to_device messages
• react-sdk (and riot-android, riot-ios)
  • [x] convert SAS code from olm into something human-readable (hex/words/emoji)
  • [x] general UI work

QR code

• spec
  • [ ] decide how to prevent Bob from blindly clicking "OK" before Alice's devices gives the :+1:
  • [ ] decide on any other outstanding issues
  • [ ] get the MSC accepted
• synapse: no work needed
• libolm: no work needed
• js-sdk (and android-sdk, ios-sdk)
  • [ ] handle sending/receiving to_device messages
  • [ ] generate URL for QR code
  • [ ] verify URL from QR code
• react-sdk (and riot-android, riot-ios)
  • [ ] generate QR code
  • [ ] scan QR code (maybe use https://github.com/schmich/instascan for web?)
  • [ ] general UI work

[nadonomy]

Note: @lampholder and I just had a discussion where we raised that monodirectional first, and updating to bidirectional isn't without fault.

Is it better to just ship 'verification' once and not have a security system change? Does that reduce user confusion/inspire more confidence in our security?

[uhoreg]

interactive (SAS) verification

• spec
  • [x] decide what emoji to use
  • [x] decide how many bits to verify (i.e. the size of the SAS)
  • [ ] decide on any other outstanding issues
  • [ ] get the MSC accepted
• synapse: no work needed
• libolm
  • [x] SAS module (or any better name)
  • create/delete session
  • generate SAS code (as an array of numbers)
  • hash data
• js-sdk (and android-sdk, ios-sdk)
  • [x] handle sending/receiving to_device messages
• react-sdk (and riot-android, riot-ios)
  • [x] convert SAS code from olm into something human-readable (hex/words/emoji)
  • [x] general UI work

QR code

• spec
  • [ ] decide how to prevent Bob from blindly clicking "OK" before Alice's devices gives the :+1:
  • [ ] decide on any other outstanding issues
  • [ ] get the MSC accepted
• synapse: no work needed
• libolm: no work needed
• js-sdk (and android-sdk, ios-sdk)
  • [ ] handle sending/receiving to_device messages
  • [ ] generate URL for QR code
  • [ ] verify URL from QR code
• react-sdk (and riot-android, riot-ios)
  • [ ] generate QR code
  • [ ] scan QR code (maybe use https://github.com/schmich/instascan for web?)
  • [ ] general UI work