Opened 20 months ago

Last modified 9 months ago

#17833 assigned defect

Two contacts dangerously merging as one

Reported by: cypherpunks Owned by: arlolra
Priority: Very High Milestone:
Component: Applications/Tor Messenger Version: Tor: unspecified
Severity: Critical Keywords:
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

Received a message apparently coming from PERSON A. From the very first line it became obvious that I was not communicating with a PERSON A but with someone else, I then quit Tor Messenger at once. Past initial confusion I contacted PERSON A via alternative channel to confirm that they did not send this message.

When I started Tor Messenger again, a new conversation was initiated, apparently by PERSON A, but this time, after the message, Tor Messenger displayed the following (see screenshot wtf2.png):
"

  • The current conversation is private bu *PERSON B*'s identity has not been verified.
  • The conversation will continue with PERSON A, using XMPP
  • Private conversation with PERSON A started. However, their identity has not been verified.

"

However, despite this, I was still talking with PERSON B. Please note that contact with PERSON B was already supposed to be (unverified) in my contact list at that time, but somehow has disappeared from it.

Confusing, isn't it? :)

I tried to understand a bit of what was happening, and as seen on screenshot "wtf5.png", upon hovering over PERSON A's account icon, 2 accounts are now listed: "(unverified) PERSON A" and "(verified) PERSON A".

Upon clicking "(unverified) PERSON A" it is now clear that I actually open a conversation with PERSON B, as, when i try to verify this person's identity, a popup mentions (see screenshot "wtf.png") "verify PERSON B", while staying empty of any interface elements to verify it...

It appears that PERSON A and PERSON B are somehow merged into PERSON A's conversation window.

This could lead to very dangerous confusion... I hope this helps to further identify the source of the bug.

Child Tickets

Attachments (5)

wtf.png (19.5 KB) - added by cypherpunks 20 months ago.
wtf2.png (41.8 KB) - added by cypherpunks 20 months ago.
wtf4.png (24.6 KB) - added by cypherpunks 20 months ago.
wtf4.2.png (24.6 KB) - added by cypherpunks 20 months ago.
wtf5.png (57.9 KB) - added by cypherpunks 20 months ago.

Download all attachments as: .zip

Change History (13)

Changed 20 months ago by cypherpunks

Changed 20 months ago by cypherpunks

Changed 20 months ago by cypherpunks

Changed 20 months ago by cypherpunks

Changed 20 months ago by cypherpunks

comment:1 Changed 20 months ago by ioerror

This bug is legit - it just caused a user to believe they were talking with me, when they were talking with someone completely different. We were otherwise verified but I was entirely offline. My account was not compromised, nor were my otr keys used by this other user account.

comment:2 Changed 20 months ago by arlolra

  • Owner set to arlolra
  • Status changed from new to assigned

Thanks for reporting. That does look "dangerous". Investigating.

comment:3 follow-up: Changed 20 months ago by arlolra

I was able to reproduce some of what was happening: https://cl.ly/1P172f0q101P

In wtf2.png, the conversation starts off with *******@jabber.ccc.de. Can you open Tor Messenger, find that user in contacts menu, click them, then you should see a little down arrow appear. Click that and it should show the merged accounts. If what I suspect is happening, these contacts got accidentally merged. Right-click (context menu) on ioerror@jabber.ccc.de and choose "Detach from contact".

Please confirm if I'm way off base.

If it's the case though, we need to either do a much better job of handling merged contacts or disable the "feature" altogether.

comment:4 Changed 20 months ago by arlolra

#17628 is another case of users being confused by contact merging (though to that point with less serious consequences).

comment:5 in reply to: ↑ 3 Changed 20 months ago by cypherpunks

In my case PERSON B is not listed anymore in the contact list, so there was no "little down arrow" to click... but i see what you mean with contact merging, therefore i had this idea:

I closed Tor Messenger and opened Pidgin with the same account. There, two un-merged accounts were listed, both as "PERSON A", while one of them was obviously "PERSON B" as shown in the tooltip.

So what seems to have happened is that somehow the two got merged and/or messed up in Tor Messenger, with one of the two getting the ID of the second one... Still they are not technically "merged contacts".

Replying to arlolra:

I was able to reproduce some of what was happening: https://cl.ly/1P172f0q101P

In wtf2.png, the conversation starts off with *******@jabber.ccc.de. Can you open Tor Messenger, find that user in contacts menu, click them, then you should see a little down arrow appear. Click that and it should show the merged accounts. If what I suspect is happening, these contacts got accidentally merged. Right-click (context menu) on ioerror@jabber.ccc.de and choose "Detach from contact".

Please confirm if I'm way off base.

If it's the case though, we need to either do a much better job of handling merged contacts or disable the "feature" altogether.

comment:6 Changed 20 months ago by arlolra

Thanks for the follow up.

In my case PERSON B is not listed anymore in the contact list, so there was no "little down arrow" to click...

Did you try looking under ioerror@jabber.ccc.de? If Pidgin is reporting that the two contacts are still associated with the account, it should be possible to find it in Tor Messenger. Here's a screenshot of the arrow, in case it helps: http://cl.ly/3L0l1s0g1L0A

So what seems to have happened is that somehow the two got merged and/or messed up in Tor Messenger

I suppose I need to audit the code to see under what conditions accounts can be merged.

comment:7 Changed 9 months ago by arlolra

  • Keywords XMPP Messenger accounts merge removed

comment:8 Changed 9 months ago by arlolra

  • Summary changed from Two contacts ! dangerously ! merging as one to Two contacts dangerously merging as one
Note: See TracTickets for help on using tickets.