deltachat-core-rust
deltachat-core-rust copied to clipboard
deltachat
Add API to change database passphrase
shouldn't maual changes of the database encryption passphrase include a verification step that the user knows the old passphrase? In terms of this api: shouldn't we pass the old passpharase as a parameter (exception: it was a random generated passphrase by the device)
@cyBerta Even DC itself does not know the passpharse at this point. We can of course try to open another connection with old passphrase, but I don't see what does this solve? Similar to how websites require you to enter old passphrase so someone cannot change the passphrase if you forgot to lock the screen?
On the phone asking for device key (unlock screen) maybe? At least on Android this is what DC does when you try to export the secret key (though for backup which contains the same key it doesn't currently).
I guess the testing the user knows the old password is something the UI could do on its own. though there is also nothing that stops the ffi api requiring the old password so that it is a bit more prescriptive instead of up the the UIs to do the same.
check_password already exists and could be merged into the rekey function to only get the pool write lock once.
On the phone asking for device key (unlock screen) maybe? At least on Android this is what DC does when you try to export the secret key (though for backup which contains the same key it doesn't currently).
Are you sure? DC Android does ask for my fingerprint when I want to export a backup.
On the phone asking for device key (unlock screen) maybe? At least on Android this is what DC does when you try to export the secret key (though for backup which contains the same key it doesn't currently).
Are you sure? DC Android does ask for my fingerprint when I want to export a backup.
Sorry, just checked, it actually does require to unlock to export the backup too.
Then I think the procedure for changing the passphrase could be the same, asking for device key rather than the database key which the user may not know if it's in the keystore.