Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fingerprint verification is no longer accurate. #1091

Closed
andyholmes opened this issue Apr 4, 2021 · 3 comments · May be fixed by #1148
Closed

Fingerprint verification is no longer accurate. #1091

andyholmes opened this issue Apr 4, 2021 · 3 comments · May be fixed by #1148
Labels
security Encryption, Privacy or other data exposure

Comments

@andyholmes
Copy link
Collaborator

Since a few months ago, KDE Connect stopped using a pair of SHA1 fingerprint hashes to confirm pairing, and now uses a SHA256 hash of the combination of both certificates.

This is unfortunate since it means any older version of KDE Connect or GSConnect connecting to an Android device will appear to be fraudulent. The affects all versions of GSConnect up to v46.

See:
@andyholmes andyholmes added the security Encryption, Privacy or other data exposure label Apr 4, 2021
@ghost
Copy link

ghost commented Apr 12, 2021 •
edited by ghost
Loading

The fingerprints didn't match when I looked at the encryption info. Not sure if this is related or not.

@andyholmes
Copy link
Collaborator Author

Yup, that's one half of the issue.

@strugee strugee mentioned this issue Jul 27, 2021
Merged
strugee added a commit to strugee/gnome-shell-extension-gsconnect that referenced this issue Jul 27, 2021
@strugee
Show SHA256 fingerprints
0a4ca25 
I changed the monkeypatched function name to improve clarity (what kind
of fingerprint is it?) and also to avoid clashing with future GLib APIs.

Fixes GSConnect#1091
strugee added a commit to strugee/gnome-shell-extension-gsconnect that referenced this issue Jul 27, 2021
@strugee
Show SHA256 fingerprints
43b4e94 
I changed the monkeypatched function name to improve clarity (what kind
of fingerprint is it?) and also to avoid clashing with future GLib APIs.

Ref GSConnect#1091
andyholmes pushed a commit that referenced this issue Jul 27, 2021
@strugee
Show SHA256 fingerprints (#1147)
91e4390 
I changed the monkeypatched function name to improve clarity (what kind
of fingerprint is it?) and also to avoid clashing with future GLib APIs.

Ref #1091
strugee added a commit to strugee/gnome-shell-extension-gsconnect that referenced this issue Jul 29, 2021
@strugee
Use KDE Connect's verification codes
f5b6558 
Fixes GSConnect#1091
@strugee strugee mentioned this issue Jul 29, 2021
Draft
strugee added a commit to strugee/gnome-shell-extension-gsconnect that referenced this issue Jul 29, 2021
@strugee
Use KDE Connect's verification codes
5731b63 
Fixes GSConnect#1091
strugee added a commit to strugee/gnome-shell-extension-gsconnect that referenced this issue Jul 29, 2021
@strugee
Use KDE Connect's verification codes
a8f73c6 
Fixes GSConnect#1091
ferdnyc pushed a commit to strugee/gnome-shell-extension-gsconnect that referenced this issue Oct 24, 2022
@strugee @ferdnyc
Use KDE Connect's verification codes
1bb11b2 
Fixes GSConnect#1091
@andyholmes
Copy link
Collaborator Author

Closed by #1493

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
security Encryption, Privacy or other data exposure
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Use KDE Connect's verification codes strugee/gnome-shell-extension-gsconnect
1 participant
@andyholmes