search

oxen-io / session-android

A private messenger for Android.
https://getsession.org
GNU General Public License v3.0
1.81k stars 169 forks source link

Report when Session client is outdated #947

Open erdh opened 2 years ago

erdh commented 2 years ago

While chatting with my friend who somewhat didn't updated their Session client, which fixed a bug about disappearing messages on iOS platform, (patch 2.0.1) which made the chats that are intended to disappear weren't disappeared and caused a security panic for both end. If the other end or you are not in charge that client is not running the latest patches that fixes important issues, might cause big problems when critical bugs are patched.

Could be replicated with just chatting with someone that doesn't have the latest patch.

If the Session app would just give a message that this client is not the latest patch, might fix issues quicker because the user is now warned.

hjubb commented 2 years ago

The main concern that would come alongside this is that you will know or reveal to the people you are chatting with what platform and version of the application you are using, which can be used to identify you. It could be worthwhile to know on your own device if there is an updated, however it would then still be on the individual to do anything about it

erdh commented 2 years ago

Yes, on second thought, depends on the threat model, giving info that the other hand is not using latest patch might reveal a bit info about them. If the Session app would give a message to client that they are not using the latest patch, (of course we can not force them) that will possibly encourage them to update their client for safer chat for both ends.

KeeJef commented 1 year ago

Yeah i think this would be cool, we already have a similar feature in Session Desktop which reports if your version of Session is out of date, would be cool to do the same for mobile versions, would be useful for people who directly download the APK version.