We're not slipping in our own DM key into recps anymore, keep an eye out for breakage

ssbc / ssb-tribes

GNU Lesser General Public License v3.0

26 stars 4 forks source link

We're not slipping in our own DM key into recps anymore, keep an eye out for breakage #101

Open Powersource opened 11 months ago

Powersource commented 11 months ago

In the db2 PR https://github.com/ssbc/ssb-tribes/pull/96 we're removing envelope.js in favor of ssb-box2. envelope.js had this hack that tries to put out own dm key into all the content.recps. Removing that should be fine but let's keep an eye out in case something was depending on that.

https://github.com/ssbc/ssb-tribes/blob/134064ba84e7d49c292349aa00aeccd42f2103b4/envelope.js#L37-L41

mixmix commented 10 months ago

yeah I can't remember the reason for this... but I don't like how sneaky it is.

I think the justification was that with box2 it's impossible to send one-way messages (unlike box1), as you are always doing a diffie-hellman cross between your key and another persons.... I'm fuzzy on this though

mixmix commented 5 months ago

I think this is fine. We will be doing thorough testing, so will watch for anything odd.

We need to revisit key backup in future...