Remove protected chats and expire auth tokens #7116

link2xt · 2025-08-16T02:26:16Z

Since key-contacts cannot change their keys and having "verification" is less important for contact identification than having a chat history or shared chats with a contact, UIs have stopped displaying green checkmarks everywhere (deltachat/deltachat-android#3828).

This PR removes protected chats and replaces old mechanism of propagating verifications via protected chat messages marked with Chat-Verified: 1 header with a new _verified attribute of Autocrypt-Gossip headers.

Receiving _verified attribute in Autocrypt-Gossip is already supported in 2.13.0 release. This PR switches from using Chat-Verified header to Autocrypt-Gossip.

Closes #7080 (replace verification gossip mechanism with a new one that works using Autocrypt-Gossip header and is independent of "protected chats").

It also makes authentication tokens in QR codes expire and closes #7111
As a preparation for expiring QR codes it takes into account sync item timestamps (closes #7182) for QR code tokens, so synced QR code tokens have a timestamp of sync messages and when token removal is synchronized tokens newer than the sync item are not removed.

Also closes #7112 (removing deprecated and unneeded APIs)

Finally, this PR adds a migration that resets all indirect verifications. There was a bug #7107 (closed in #7113) that resulted in updating "verified by" information for already verified contacts, so the information about "verifiers" is lost and overwritten with incorrect indirect verifiers.
Expiring auth tokens also make new direct verifications more meaningful, but I have decided not to reset direct verifications as they are not affected by bugs that accidentally result in verifying someone directly. If the user did not publicly share the invite link, then verifications are valuable and resetting all of them will likely not be received well.

As we reset indirect verifications at the same time as we change the mechanism used to propagate verifications, old incorrect verifications will not propagate to new versions even though users do not upgrade at the same time.

We can also allow to remove verification from contacts (https://support.delta.chat/t/how-would-i-remove-the-verified-checkmarks-from-one-invite-code-in-retrospect/3403) as it will not break "protected" chats anymore, but this is out of scope for this PR.

What this PR does:

src/mimeparser.rs

src/receive_imf.rs

link2xt · 2025-08-16T02:36:25Z

test-data/message/verification-gossip-also-sent-to-from.eml

@@ -34,88 +34,112 @@ Content-Transfer-Encoding: 7bit

 -----BEGIN PGP MESSAGE-----

-wU4D5tq63hTeebASAQdATHbs7R5uRADpjsyAvrozHqQ/9nSrspwbLN6XJKuR3xcg


Payload here is replaced to have no Chat-Verified header inside and have _verified=1 in gossip headers. Payload got larger likely because rsop does not do compression and I had to reencrypt the payload.

iequidoo · 2025-09-10T09:07:23Z

src/securejoin.rs

+            let sender_is_verified = sender_contact
+                .fingerprint()
+                .is_some_and(|fp| fp == fingerprint);
+            if !sender_is_verified {


It's not verified (i.e. marked so) yet, maybe rename this to sender_is_checked?

Contacts are marked as verified in the profile, only protected/verified chats are removed.

I mean, sender_is_verified may be true, but then time() < timestamp + 600 below fails and the sender won't be actually verified. The variable name may be confusing

iequidoo · 2025-09-10T09:07:28Z

src/sync.rs

@@ -258,8 +258,8 @@ impl Context {
        for item in &items.items {
            match &item.data {
                SyncDataOrUnknown::SyncData(data) => match data {
-                    AddQrToken(token) => self.add_qr_token(token).await,
-                    DeleteQrToken(token) => self.delete_qr_token(token).await,
+                    AddQrToken(token) => self.add_qr_token(token, item.timestamp).await,


This is a remote timestamp, so better to limit it like MimeMessage::get_timestamp_sent() does, maybe even w/o any tolerance

Probably makes sense to limit sync item timestamps at the time of parsing sync items rather than everywhere they are used.

iequidoo · 2025-09-10T09:07:38Z

src/chat.rs

+        let chat = Chat::load_from_db(context, chat_id).await?;
+        if chat.is_encrypted(context).await?
+            && !chat.param.exists(Param::Devicetalk)
+            && !chat.param.exists(Param::Selftalk)


This is fine, but probably https://delta.chat/en/help#save should say that saved messages are encrypted (if they are sent of course, e.g. in a multi-device case)

This mechanism replaces `Chat-Verified` header. New parameter `_verified=1` in `Autocrypt-Gossip` header marks that the sender has the gossiped key verified. Using `_verified=1` instead of `_verified` because it is less likely to cause troubles with existing Autocrypt header parsers. This is also how https://www.rfc-editor.org/rfc/rfc2045 defines parameter syntax.

Create unprotected group in test_create_protected_grp_multidev The test is renamed accordingly. SystemMessage::ChatE2ee is added in encrypted groups regardless of whether they are protected or not. Previously new encrypted unprotected groups had no message saying that messages are end-to-end encrypted at all.

link2xt force-pushed the link2xt/ykltkokxntvk branch from c7e6f1c to e180d7f Compare August 16, 2025 02:32

link2xt commented Aug 16, 2025

View reviewed changes

link2xt force-pushed the link2xt/ykltkokxntvk branch 4 times, most recently from 867c2ba to 780ca50 Compare August 17, 2025 02:31

link2xt mentioned this pull request Aug 17, 2025

Remove is_profile_verified() and is_protected() APIs #7112

Open

link2xt force-pushed the link2xt/ykltkokxntvk branch 3 times, most recently from 53d6a2d to a6301b9 Compare August 17, 2025 06:22

link2xt added the verified-chats label Aug 17, 2025

link2xt changed the title ~~feat: verify contacts via Autocrypt-Gossip~~ Verification v2 Aug 17, 2025

link2xt mentioned this pull request Aug 17, 2025

Expire the verification-property of QR codes #7111

Open

link2xt force-pushed the link2xt/ykltkokxntvk branch 11 times, most recently from 88700f4 to 5b31b5d Compare August 19, 2025 21:16

link2xt changed the title ~~Verification v2~~ Remove protected chats Aug 20, 2025

link2xt force-pushed the link2xt/ykltkokxntvk branch from 6b67844 to 6052d1a Compare August 20, 2025 03:33

Hocuri mentioned this pull request Aug 27, 2025

feat: Synchronize encrypted groups creation across devices (#7001) #7009

Open

link2xt force-pushed the link2xt/ykltkokxntvk branch from 6052d1a to 4e956bd Compare August 28, 2025 06:47

link2xt marked this pull request as ready for review August 28, 2025 08:37

link2xt force-pushed the link2xt/ykltkokxntvk branch from f1389dd to 701dafe Compare August 28, 2025 08:48

link2xt force-pushed the link2xt/ykltkokxntvk branch from f035394 to 9225ad2 Compare September 9, 2025 01:45

link2xt changed the title ~~Remove protected chats~~ Remove protected chats and expire auth tokens Sep 9, 2025

link2xt force-pushed the link2xt/ykltkokxntvk branch from 025d9f1 to 2a22afb Compare September 9, 2025 02:36

link2xt mentioned this pull request Sep 8, 2025

Take sync message timestamp into account for QR tokens #7182

Open

link2xt force-pushed the link2xt/ykltkokxntvk branch 10 times, most recently from 1e435ca to 66bffdb Compare September 9, 2025 08:20

link2xt mentioned this pull request Sep 9, 2025

Dedicated API and UI for verification failure in protected groups #4999

Closed

iequidoo self-requested a review September 10, 2025 06:21

iequidoo reviewed Sep 10, 2025

View reviewed changes

link2xt added 5 commits September 12, 2025 15:10

fix: don't ignore QR token timestamp from sync messages

18e2cdf

docs: document Autocrypt-Gossip _verified attribute

f470125

api: make dc_chat_is_protected always return 0

2af40b4

api!: remove public APIs to check if the chat is protected

c0bb8f4

link2xt force-pushed the link2xt/ykltkokxntvk branch from 66bffdb to 0f94529 Compare September 12, 2025 15:10

link2xt added 5 commits September 13, 2025 00:15

api!: remove Chat.is_protected()

9257210

refactor: remove ProtectionStatus

41d5c57

feat: do not mark Bob as verified if auth token is old

01d520d

feat: reset all indirect verifications

5051240

link2xt force-pushed the link2xt/ykltkokxntvk branch from 0f94529 to 5051240 Compare September 13, 2025 00:16

link2xt mentioned this pull request Sep 17, 2025

fix: Delete obsolete "configured*" keys from config table (#7171) #7204

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Remove protected chats and expire auth tokens #7116

Remove protected chats and expire auth tokens #7116

link2xt commented Aug 16, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

link2xt Aug 16, 2025

Uh oh!

iequidoo Sep 10, 2025

Uh oh!

link2xt Sep 10, 2025

Uh oh!

iequidoo Sep 11, 2025

Uh oh!

iequidoo Sep 10, 2025

Uh oh!

link2xt Sep 10, 2025

Uh oh!

iequidoo Sep 10, 2025

Uh oh!

Uh oh!

		@@ -34,88 +34,112 @@ Content-Transfer-Encoding: 7bit

		-----BEGIN PGP MESSAGE-----

		wU4D5tq63hTeebASAQdATHbs7R5uRADpjsyAvrozHqQ/9nSrspwbLN6XJKuR3xcg

Uh oh!

Remove protected chats and expire auth tokens #7116

Are you sure you want to change the base?

Remove protected chats and expire auth tokens #7116

Conversation

link2xt commented Aug 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

link2xt Aug 16, 2025

Choose a reason for hiding this comment

Uh oh!

iequidoo Sep 10, 2025

Choose a reason for hiding this comment

Uh oh!

link2xt Sep 10, 2025

Choose a reason for hiding this comment

Uh oh!

iequidoo Sep 11, 2025

Choose a reason for hiding this comment

Uh oh!

iequidoo Sep 10, 2025

Choose a reason for hiding this comment

Uh oh!

link2xt Sep 10, 2025

Choose a reason for hiding this comment

Uh oh!

iequidoo Sep 10, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

link2xt commented Aug 16, 2025 •

edited

Loading