quarkslab / mattermost-plugin-e2ee

End-to-end encryption plugin for Mattermost
Apache License 2.0
65 stars 8 forks source link

[webapp] Warn when a new e2ee recipient appears in a channel #11

Closed aguinetqb closed 2 years ago

aguinetqb commented 2 years ago

A compromised server could add the attacker as some form of ghost user in some channels, and have the legitimate users encrypt messages for an attacker-controlled public key.

We need to warm users, on each sent messages, if there is a new user involved in the list of recipients.