Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Change history_visibility for new private rooms to invite #587

Open
PeerD opened this issue Jan 28, 2020 · 0 comments
Open

Change history_visibility for new private rooms to invite #587

PeerD opened this issue Jan 28, 2020 · 0 comments
Labels
A-Client-Server Issues affecting the CS API enhancement A suggestion for a relatively simple improvement to the protocol

Comments

@PeerD
Copy link

PeerD commented Jan 28, 2020

The room history is always set to shared (https://matrix.org/docs/spec/client_server/r0.6.0#post-matrix-client-r0-createroom). This results in the following problem:

User A and User B start a private conversation (with default settings)
User A and B chat about private/confidential matters
User A invites User C to the conversation
User C can see the entire history
This could result in serious Problems for the affected users including security (leaked passwords), bullying (private information being disclosed) etc.

By changing this to invite for private conversations (trusted_private_chat) and possibly even for private rooms (private_chat) this problem is mitigated by only allowing new people to see messages created after their invite (which is visible to all previous room members). In my opinion this is the more reasonable default value.

With shared history, the invitation of a new room member can have serious implications for the previous members. With history set to invited, the "worst case" is that information has to be resend to the channel for the new member.

#289 goes into the same direction, but this is a quick and easy solution to the problem with little work and quick to implement in comparison. And it solves many of the same problems. So even if you change the room later, the private parts stay private (unless explicitly set to shared again during room creation).

@turt2live turt2live added A-Client-Server Issues affecting the CS API enhancement A suggestion for a relatively simple improvement to the protocol labels Jan 28, 2020
@richvdh richvdh transferred this issue from matrix-org/matrix-spec-proposals Mar 1, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
A-Client-Server Issues affecting the CS API enhancement A suggestion for a relatively simple improvement to the protocol
Projects
None yet
Development

No branches or pull requests

2 participants