TryQuiet/quiet @quiet/mobile@9.0.2

on GitHub

Features

• Add beta warning message to desktop when creating/joining a community #3351

Breaking

• Update data directories for 9.x #3379
• Tighten controls on channel metadata DB operations, move private channels to separate metadata DB #3329
• Use chain permission checks to gate channel creation, deletion and membership #3344
• Use randomly generated role names for private channels #3354
• Tighten user profile store access control and validations #3340

Fixes

• Suppress per-message notifications on Android and iOS for users with unknown usernames, and for one's own messages #3451
• iOS tor process lifecycle improvements solving crashes and improving performance #3349
• Update LFA to remove flaky timestamp validator #3365
• Improve image compression efficiency #3364
• Fix OrbitDB indexing to avoid overwriting previously indexed deletions with puts #3393
• Fix validations of private channel deletions #3392
• Pass channel ID to name mappings to mobile native storage and use in notifications #3387
• Make usernames and profile photos tapable when adding members to private channel #3371
• Update desktop Tor binaries to Tor 0.4.9.11 (Tor Browser 15.0.21) and fix the update script to extract LZMA-compressed macOS DMGs with 7-Zip instead of dmg2img
• Update Android libtor.so to Tor 0.4.9.11 (16KB page aligned, from Tor Browser 15.0.21) and re-enable Android in the Tor binary update script
• Fix the Android app crashing on every launch after the Tor 0.4.9.11 upgrade: the --hash-password call now passes an explicit --DataDirectory instead of falling back to the binary's compiled-in default (/data/local/tmp), which the app's uid cannot read #3449
• Android push notifications now appear for a device that joined a community and then saw no further membership changes; previously every background push was silently dropped #3446
• An invitee's admission is now saved to the sigchain by the admitting member device or storage service (QSS) before the invitee's acceptance is sent, so a crash or restart on the admitter can no longer leave the new member accepted on their side but absent from the admitter's chain #3443
• Fix intermittent Android crash under memory pressure, where JavaScriptCore handed the allocator a heap pointer with a truncated tag while responding to a low-memory callback and the app was aborted #3450

Security

• Sigchain changes were not signed, so any community member could forge changes attributed to another member: promoting themselves to administrator, removing any member including the founder, or re-keying a private channel they were never admitted to so that they could read its future messages while locking out the real members. Every sigchain change and identity is now bound to the device key that signed it, and the community state handed to a new member is encrypted to that member and authenticated #3444
• The storage service (QSS), which is designed as an untrusted relay, could add an identity it controlled to a community as a full member without any invitation and then read everything shared with members. Servers now hold a separate self-certifying identity that cannot act as a member, and membership changes must be signed by a registered member device #3454
• A community member could register a device under another member's account, because nothing bound the author of a device addition to the account it named #3455
• Anyone who observed an invitation proof, such as the member accepting it or the storage service relaying the handshake, could replay it to be admitted to the community. Admission now requires a signature from the joining device's own key over a single-use challenge #3456
• Any community member could inject new team, role, or channel keys through unvalidated key deliveries, taking over a private channel and excluding its members. Unauthorized re-keys are now dropped #3431
• An ordinary member could promote another member straight to administrator, because role grants were not administrator-gated. This fix shipped in 7.3.x, was reverted in 8.0.0, and is restored #3457
• A member of a channel could post a message in that channel that all clients displayed as coming from a different member, without that member's key. Messages are now cryptographically verified against their author before they are stored, shown, or used for notifications #3438
• An ordinary member could sign a shared-database entry with their own key while labelling it with an administrator's identity, and so pass administrator-only checks, for example to delete public channels or other members' profiles. Database entries are now bound to the device key that signed them #3441
• An administrator could replace another member's account keys with keys the administrator controls and then sign messages, including direct messages, as that member. Only a member can now change their own keys #3440
• An ordinary member could grant the basic member role to any user rather than only to themselves. This had no effect today because every member already holds that role, but it would have let a single member undo an administrator's removal of another member once removal ships. Non-admins can now only claim self-assignable roles for themselves #3432
• An administrator could create a role named __proto__, which corrupted the role state of every peer that synced it and disabled the checks that reject malformed sigchain changes. Such names are now rejected and role lookups no longer touch object prototypes #3437
• A community member could make background push notifications on iOS and Android show a forged sender or content, because iOS did not verify the message signature and Android did not check that the signer matched the claimed sender. Both platforms now verify the author before displaying a notification #3435
• A community member could send arbitrary notification text to another member's iOS device, enabling lock-screen phishing, because every member's push token is replicated to the whole community and the storage service accepted caller-supplied title and body. Clients no longer send notification content, and the service derives routing from the signed token #3439
• A malicious or compromised storage service (QSS) could have a device sign an unbound challenge with its device key, then replay that signature at a different storage service to impersonate the device there. Devices now sign only challenges bound to their own identity, team, and pinned server #3436
• A community member could send a message whose attachment metadata pointed at a different message or channel, or referenced hosted media without encryption metadata. Attachment metadata is now strictly validated against the signed message #3430
• Anyone who could reach a community's storage service (QSS), without authenticating, could crash it by sending a websocket event without an acknowledgement callback, interrupting sync and push delivery for every community on that instance. Malformed events are now rejected without crashing the service #3442