Wire-webapp: Unknown people appear in the contact list

[maximbaz]

I'm describing this issue on behalf of someone else, but I have access to their devices if any extra data is needed. Furthermore, I am actually hearing about this issue for the second time from different people (it has never happened with my personal account though), but this is the first time I see it with my own eyes.

---

Today a message on the Wire for Android appeared saying "Demetroid has approved your request". The problem is, I don't know who this Demetroid is, and I certainly did not send any request to anyone recently. This "Demetroid" appeared in the contact list on both Wire for Android and Desktop.

Is there any way to track what is going on? Maybe find out, when and which device sent this request?

[someoneEsle]

This looks like an auto-connect: Demetroid must be someone in your friend's address book. It is true that no one sent any connection request, but because your friend has shared their contacts with wire, when Demetroid joined Wire they were connected automatically.
If your friend wants to know who Demetroid is, tell them to:

1. Open Wire on Android
2. Open the conversation with Demetroid
3. Tap "Demetroid" in the top bar
4. Now they should see what Demetroid is called in their address book

Lastly, let me add that this would be mitigated by fixing https://github.com/wireapp/wire-android/issues/248, but the initial message after an auto-connect should also be updated.

[maximbaz]

Thanks for the hint @someoneEsle! I asked to do what you suggested, however there is no extra information on that screen that would determine Demetroid's identity. There's definitely no phone contact named Demetroid. So... it's probably caused by something else?

That is a wrong place to ask probably, but is there a way to disable auto-connect feature, just in case? If they revoke "Read contacts" permission for the wire app (you can do that in phone settings > apps > wire), is it going to help or is it too late? I guess it's too late, right?

[someoneEsle]

I think that Demetroid has your friend's number in their address book, even though your friend doesn't have Demetroid's.

As for whether or not revoking contacts access would help with auto connect, I honestly don't know.

[maximbaz]

Thanks! I would be interested to hear Wire member's comment on that, I hope it's not the case (because otherwise someone would just create an enormously large contact list on their phone, with all possible numbers, and the numbers that actually resolve to a wire account would be added as their contacts _and be auto-approved_).

At this point I'm curious if there is any way at all to prove that Demetroid was added specifically as a result of auto-connect feature, and not let's say a random person exploiting Wire's vulnerability and bypassing the approval step. I know I can just block this contact, but I don't want to see new random people appearing in my contact list every week.

By the way, I've just found https://github.com/wireapp/wire-android/issues/317. Not to reopen that issue, @bjoernherbig maybe you could comment on the points above?

[bjoernherbig]

Apologiesfor the late reply. Yes, it is a one way autoconnect that you are getting. This is also the reason why you do not see any additional information in the profile card, like e.g. the users name in your addressbook or alike.
We also see issues with this behaviour and plan changes regarding the autoconnections. Until those are implemented you should block users as described by you, sorry.

[helenakos]

@maximbaz The notification text you saw ("Demetroid has approved your request") should actually be something else, we changed it some time ago. We opened an issue internally, thanks for noticing!

[gregor]

@maximbaz If I understand your report correctly, the confusing notification text was shown on Android and not web/desktop. We have changed the copy in this case on those platforms and I do not see a regression introduced since #621. @bjoernherbig should be aware of the missing DCR implementation on Android and continue to track this for said platform. If this happens on web/desktop, please let me know.

[maximbaz]

My report was mostly about a possibility to bypass the confirmation in order to become a contact. While this is a huge and easily exploitable breach in my mind, now I understand that this is caused by Android version, though the effects are visible on all platform afterwards.

I'm fine with closing this issue on the webapp side, as long as it is tracked somewhere :slightly_smiling_face:

[gregor]

Yes, fully agree on that one. One-way auto-connects are not the way to go and this will be changed going forward - without comitting to a timeline. Was asking for your confirmation as the ticket filed internally was asking me to fix a non existent regression with the user connection notification copy shown on web/desktop.

[feutl]

just wanted to jump onto this as well.
some friends of mine just installed wire, they got "autoconnected" with me via there address book but I cannot see which of them are connected how. The detail view on the webapp or ios app does not show any details of the contact only the picture an the username.

which makes it really hard for people just called xxx or michi or whatever to associate them to the real person without asking stupid questions.

I also would prefer to see the addressbook name instead of their chosen nickname.

thanks

[gregor]

Thank you for your feedback on this feature. We are still evaluating how to move forward with our address book upload across all platforms. There are no immediate changes on the roadmap. I am thus going ahead and closing this issue for now as it is not specific to the webapp but geared towards Wire in general.

[feutl]

how is this getting tracked if the ticket is closed and no reference to a new feature tickt got included in here?