search

kontalk / desktopclient-java

Kontalk official platform independent desktop client
https://www.kontalk.org
GNU General Public License v3.0
57 stars 24 forks source link

[Windows] - Desktop Client seems to auto-accept chat requests #41

Closed M4v3r1cK87 closed 9 years ago

M4v3r1cK87 commented 9 years ago

It seems the Desktop client auto-accepting key changes.

I write a message to my friend that show in the contacts list, i sent a message to you and you sent message to me, and so far so good... But when I enter in the chat from the android app the client show me the request to chat (saying that the encryption key was wrong).

From the desktop app: daniele_desktop

From the android app: screenshot_2015-07-15-10-51-55

abika commented 9 years ago

yes, that's the current intended behaviour, have to think about this...

abika commented 9 years ago

I have still no clue what to do here. Ok, the user should see a least a warning when the key changes, but the option to refuse the new key seems useless...

daniele-athome commented 9 years ago

@abika if you click the reject button (actually "block") it unsubscribes from the user and blocks it. Why do you think it's useless?

abika commented 9 years ago

oh ok, sorry. I thought only the new key is just ignored. But that behaviour clearly makes sense.

Will the Android client recognize it if the Destop client does the same?

daniele-athome commented 9 years ago

It should: the blacklist is per-user.

abika commented 9 years ago

quick question here: why unsubscribing? When the contact is blocked no presence stanzas are received for this contact anymore, so isn't blocking enough?

daniele-athome commented 9 years ago

I thought removing it from the roster entirely would be more "complete" (you are indeed blocking a person and you don't want to see him/her again :-)

abika commented 9 years ago

okay, but I think only blocking is more appropriate here: Most of the time a key change occurs the reason is legitimate, and if the user is really unsure about it blocking is enough to prevent insecure communication but makes it easier to reestablish communication maybe after the key was verified using some other channel. (Key change-> I'm unsure & block -> call the contact: ok, not the CIA -> unblock)

Thus the Desktop client will only block

daniele-athome commented 9 years ago

You're right. I will align the Android app.