#Flaws in deleted keybase kept chat how to
#Flaws in deleted keybase kept chat software

That being said, you will have to make some executive decisions here. But that means that the application contains all what is required for the system to ask to send everything to a rogue address. If a user genuinely changes their smartphone, they 'automagically' recover all of their old messages. WhatsApp, for example, chose to implement the ability for a user to ask for a re-send of all their passed (received) messages without the sender being aware of that.

#Flaws in deleted keybase kept chat software

Said differently: even if traffic were encrypted, the software can still access old messages - which defeats the point of E2E. If you stray from that path, you will fall in a grey zone where everything is E2E encrypted but some features allow to recover messages. If you want true E2E encryption, end users are responsible for their keys and for possible backups of their messages. You have found another example of the balance security vs usability. (Receiver-Sender) But I don't know how effective it would be tho.Īny help would be great. I read something about re-encrypting and re-sending the messages from the other user. So, how should I handle this issues? How does WhatsApp do it while using End-To-End encryption? You can restore the old messages in WhatsApp after changing device, updating or re-installing the app etc.

#Flaws in deleted keybase kept chat how to

I thought storing the private key after encrypting it with user password, it would be secure since I don't know the user's password, but it fails too if user lost his/her password and re-creates one with a 'lost my password email'.Īnd another issue is if some legal issue happens, I can't give the chat logs to police because I don't have the decrypted messages or I don't know how to decrypt them because I don't have the private key. I thought storing the private key in server but it won't be secure at all. I know I can create new key pairs for future messages but how can I restore the old ones?

If user changes the device or reinstalls the app, the private key which stored on client will be lost. So End-To-End encrypted messaging is done. I'm thinking of using End-To-End encryption for it but I've got some issues.Įach user will have private and public keys to encrypt and decrypt the data (asymmetric key encryption) and I figured out how to exchange this keys between. Since I wanted to make it secure, I'll do some encryption to messages and the data. I'm creating a mobile app which has chat feature in it.