7.1 Merge Required To Fix Secure Value Recovery (SVR2) / Accounts With PIN

mollyim / mollyim-android

Enhanced and security-focused fork of Signal.

GNU Affero General Public License v3.0

1.37k stars 77 forks source link

7.1 Merge Required To Fix Secure Value Recovery (SVR2) / Accounts With PIN #293

Closed miles992 closed 3 months ago

miles992 commented 3 months ago

Is there an existing issue for this?

[X] I have searched the existing issues

Bug description

A merge of 7.1 is required to get Secure Value Recovery (SVR2) back to normal, at the moment it is broken in Molly too. If you have a PIN set and switch the device, you will log out from your old one and cannot proceed on the new one if trying to register the new device.

Reference: https://github.com/signalapp/Signal-Android/issues/13458

Steps to reproduce

*.) Try to switch your device with PIN set

Molly version

Latest

Android version

All

Device

All

Link to debug log

No response

valldrac commented 3 months ago

I guess you're talking about version 7.1.0, but it can't be merged yet because the source code isn't public. The latest version is actually 7.0.2 on GitHub.

miles992 commented 3 months ago

Yes true, I cannot even find a build of 7.1.0, but weird the SVR broke for older releases and there is no fix for it. At the moment recovering an account with PIN is simply not possible.

neunzehnachtneun commented 3 months ago

7.1.0 is published upstream.

https://github.com/signalapp/Signal-Android/tree/v7.1.0

miles992 commented 3 months ago

This should be the fix: https://github.com/signalapp/Signal-Android/commit/78d30fc479618a5c0959b29997a2738330227b6c

Looks as if they removed a mrEnclave passed down to Svr2Socket. mrEnclave is used as an endpoint there. Why is that so rapidly removed from the infrastructure breaking peoples accounts...