Skip to content
This repository was archived by the owner on Dec 2, 2024. It is now read-only.
This repository was archived by the owner on Dec 2, 2024. It is now read-only.

implement end-to-end encryption for private groups and dms #286

@tnix100

Description

@tnix100

Is your feature request related to a problem? Please describe.
Currently, anyone that has access to Meower's database or has correct admin permissions can read private posts sent in DMs/group chats. This is bad as an intruder or abusive sysadmin could snoop on and leak private posts.

Describe the solution you'd like
A way for posts within private group chats and direct message chats to be end-to-end encrypted.
It should:

  • Provide adequate security against insiders and intruders trying to gain access to private posts.
  • Be transparent as possible to the user (posts should still be stored by the server and able to be accessed at anytime, without the need to provide additional authentication). I could see this potentially being done by using the user's account password to establish a chain of cryptography. Obviously, using the user's account password will mean if they ever need to reset a forgotten password, they will not be able to access previously encrypted posts. However, this could be mitigated by giving users the ability to back up their encryption keys.
  • Have the ability to handle group chats up to the size of 256 members (the current member limit for group chats in Meower). Although the member limit for group chats in Meower will be increased in the near future, I think 256 members is a fair line between "public" and "private" group chats.
  • Have the ability for new members to see post history inside of group chats they are added to.
  • Have the ability for members of the chat to report posts to the Meower moderation team.
  • Have the ability to automatically regain secrecy in the event of keys being compromised.

Additional context
Ultimately, we should provide user's with as much privacy as possible without sacrificing convenience and without hindering our ability to keep Meower a safe platform.

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions