Wire-webapp: Sending only to validated devices

[IpsmLorem]

It would be interresting to have a turned on by default option: "Only send to verified devices".

A warning would be displayed when you send to recipients with some unverified devices and an error if at least one recipient of your sending has no verified device at all.

That could improve security (for just a small tradeof with friendlyness)

[helenakos]

@IpsmLorem interesting request, thanks, shared with the team!

[0ki]

Agreed. Good suggestion.

[Lehmax]

I agree that this is a good idea, but it should definitely not be turned on by default. This might scare inexperienced users away.

[IpsmLorem]

@Lehmax , if it's not a turned on by default hte app must warn people each time they send messages to unverified devices.

[raphaelrobert]

What you request is there:
https://support.wire.com/hc/en-us/articles/207859815-Why-should-I-verify-my-conversations-
https://support.wire.com/hc/en-us/articles/207149339-What-is-a-man-in-the-middle-attack-and-how-does-Wire-protect-me-from-this-
https://support.wire.com/hc/en-us/articles/207149439-What-is-a-key-fingerprint-

[IpsmLorem]

Comparing fingerprints and turning the shield icon to a half shield one is a detection means, that's good.
But preventing to send messages to unverified devices at all seems safer to me (and doesn't replace the detection feature).

[Lehmax]

It seems to me that @raphaelrobert didn't understand your suggestion.

[raphaelrobert]

If a new device is added to a verified conversation you either see a warning message when you receive a message or you see a popup screen before your message is sent. You have to take action to still send the message in that case.

[IpsmLorem]

Having to take action it's a mean to prevent sending. Thank you for pointing it out.

[IpsmLorem]

One of my recipient added a new device (the recipient was fully verified).
On iOS Wire said : "xx started using a new device". Nothing on my Wire desktop, by the way.
I tried to send a message and the application never gave me a screen sending prevention or even a warning message.
My message was just sent. If the device was added to my recipient from a malicious peer, it would have read my message.

[raphaelrobert]

Yes, this is indeed a limitation of the web app/desktop apps.

[IpsmLorem]

The message was sent via the iOS Wire version. I didn't see any prevention feature for sending the message. Did I missed something ?

[raphaelrobert]

Whenever a new device is added to a verified conversation (be it one of your devices or someone else's) the conversation status "degrades" to an unverified conversation and the blue shield disappears. This happen when you receive a message.
The indication you saw would appear in that moment and you would have to verify the additional device. Until then no further system message will be shown, even when you send a message.

If however you attempt to send a message and no system message was shown to you before (indicating that the conversation is now unverified) a takeover screen would inform you about the new device and ask you what you want to do: verify, send anyway, cancel.

That way there should be no surprises and the blue shield is always an indicator that the conversation is verified.

[IpsmLorem]

Just tried this:

• User B as a web app
• User A validates B web app
• User B log off and destroy is local data
• User B log in and a new session (key etc.) is made
• User A send a message on iOS and Wire displays "User B begin to use a new device. Are you sure you still want to send your message ? [Display device / Send anyway]"
• User A does NOT click on anything
• User B as already received the sent message even if A didn't want to

[0ki]

If what @IpsmLorem says it's true, this is a serious security bug and (s)he should be awarded a bounty. ;)

[IpsmLorem]

I still think that the most rock solid way to go is to have an option to force sending only to validated devices and no others.

[marcoconti83]

@IpsmLorem thanks for the report, we will try to reproduce the behavior you described to investigate the issue.

[marcoconti83]

@IpsmLorem actually the behavior you described seems to be an issue with iOS. I would close this ticket (as this is on the webapp repository) and create a copy on the iOS repository.