feat: treat the handle as private info #638
Draft
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Mostly an RFC. This PR will treat the instance account handle as private info.
The good
UUIDs will be used instead to distinguish your account outside of Tuba. That includes both the secrets and gsettings.
Benefits
/dev/geopjr/Tuba/.../e1cb8003-044e-4353-aa72-34aa7f9714fb/
instead of/dev/geopjr/Tuba/.../mastodon_at_mastodon_dot_social/
e1cb8003-044e-4353-aa72-34aa7f9714fb
instead of[at]mastodon[at]mastodon.social
.cache/Tuba/e1cb8003-044e-4353-aa72-34aa7f9714fb/images/
Why
An example scenario for this threat model would be: A device belonging to an activist gets compromised, either physically (if the device is unencrypted) or remotely. The attacker can easily associate them with their online accounts from Tuba using gsettings or .cache.
Obviously there will be other ways for that info to be found but since we can prevent Tuba's impact we might as well do it.
The bad
While I've set it up in a way to generate the UUID's on existing logins without having to re-auth, it might be needed if we want to use UUIDs even on secret attributes. I need to take a deeper look into it.{1}
The change is basically this:
There's an additional downside of not recognizing the keys right away.
Changing the attributes will require a re-auth.
edit: {1}
🤔
edit 2: from my understanding, gnome-keyring actually hashes the attributes which is great! This PR is probably no longer needed then