search

snikket-im / snikket-ios

Snikket iOS client
https://snikket.org/app/ios/
GNU General Public License v3.0
73 stars 10 forks source link

Use device-unique resource string #108

Closed mwild1 closed 3 years ago

mwild1 commented 3 years ago

Describe the bug Every connected XMPP session has a unique identifier, the "resource". Currently the app sets the resource to "iPhone", or rather, whatever is returned from UIDevice.current.name.

This can cause conflicts when multiple devices of the same name are on the account, and it can also cause a privacy leak by allowing people who know your address to check whether you are currently connected to the server.

Solution

A new resource string should be generated which is specific to the current app installation.

  1. It should be in the format Snikket.XXXX
  2. The XXXX should be a random alphanumeric string, e.g. QBdf, xpe2, eQDp
  3. The resource should stay the same, unless the app is uninstalled or its data is wiped.
  4. The random part should not reveal any other identifiers (but it may be derived from them).

Options:

  1. Generate and store a unique identifier for each account
  2. Hash an existing unique device/app identifier

Details (please complete the following information):