search

keybase / client

Keybase Go Library, Client, Service, OS X, iOS, Android, Electron
BSD 3-Clause "New" or "Revised" License
8.89k stars 1.23k forks source link

`keybase team request-access` claims to hide team existence, but `keybase team create` reveals it #8527

Open katrielalex opened 7 years ago

katrielalex commented 7 years ago

If I request access to a team that already exists, I get a privacy-preserving message:

~> keybase team request-access $existing_team
If "$existing_team" exists, an email has been sent to its admins, notifying of your request for access.

However, if I try to create the team, I can see whether it already exists:

~> keybase team create $existing_team
▶ ERROR team already exists (code 2619)

I'm not sure it's a bad thing to reveal the existence of teams, but these two things are not consistent :)

maxtaco commented 7 years ago

This is a good point. The error messages can use some work. But top level teams are public knowledge and subteams have names that are hidden. So probably we didn't differentiate those two cases in the request access command. Thanks for the feedback!

On Sep 19, 2017 6:57 AM, "Katriel Cohn-Gordon" notifications@github.com wrote:

If I request access to a team that already exists, I get a privacy-preserving message:

~> keybase team request-access $existing_team If "$existing_team" exists, an email has been sent to its admins, notifying of your request for access.

However, if I try to create the team, I can see whether it already exists:

~> keybase team create $existing_team ▶ ERROR team already exists (code 2619)

I'm not sure it's a bad thing to reveal the existence of teams, but these two things are not consistent :)

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/keybase/client/issues/8527, or mute the thread https://github.com/notifications/unsubscribe-auth/AA05_9VIlJbCwk_jF5CozyXd6k7HYTD2ks5sj54IgaJpZM4PcNs- .