Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

TOFU Identity change notice | Add "expert/advanced" UI to learn more about an identity change notice #2675

Open
BillCarsonFr opened this issue Dec 20, 2024 · 0 comments

Comments

@BillCarsonFr
Copy link
Member

BillCarsonFr commented Dec 20, 2024

Your use case

What would you like to do?

As a "security savy" person, I would like to be able to get more information about a user identity change notice.

image

This banner will from time to time appear in a room. And some users will see it or not depending on how long they know that user. And even a user that has multiple sessions of different age might see the banner on some devices but not others.

You also have to open a room the user is in to see it. So it is possible that you see the banner long after the identity change.

All of that makes it difficult for a security concerned user to learn a bit more on that identity change.
The best way to fix it would be to actually verify that person, but this person might be offline or not available to do the interactive verification. (note that some non tech-savy people sometimes don't remember if they did something related to their identity)

With a bit more information, an advanced user with other members could try to audit a bit and check if the change is ~sane.

How would you like to achieve it?

On the user Profile Screen, add a new advanced section called encryption.

image

In this section we want to show the user identity, a base64-encoded string for the master key similar to how device keys
E.g.
image

Adds a first time seen formatted date for that identity.

And finally a tap on the user name from the banner should open the user profile page

=> Just these information could allow me to check across my sessions and with other users that we see the same identity and also compare the time of when the change was detected

Have you considered any alternatives?

No response

Additional context

No response

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant