we haven't seen this in a while…
Today
Proper key agreement would indeed be better. However, this needs to be implemented also in the browser without using a native messaging extensions. With the latter we could use gpg-pair-tool. But that introduced yet another complicated part; so better not and re-implement such a thing in Javascript.
i'd suggest to not send an actual shared ID for verification to protect against spoofing attacks. instead, the native client (NC) should generate a six digit number (or something similar) to verify in the web client (WC). if successfully verified, NC and WC should generate a shared secret via diffie-hellman key exchange. this can then be used for challenge-response verification during re-connecting the two.
Yesterday
- The proxy server may also limit the list of ids to offer to an unconnected web client to ids of native clients running on the same ip as the web client.
Fixed and backported for VSD 3.4.
I think we also want this for VSD 3.4.
WebServer::processCommand, case Command::Register. When a web client connects, we send the mapping to both web client and native client. However, when a native client connects, we only send the mapping to the web client. We'd need both, here, too. However, we probably want to refactor both cases to use common code.
Wed, Dec 10
I have cleaned up the patches for the AppImage. Now the build fails at okular because it needs PlasmaActivities. In master this dependency has been removed so that I'm going to wait for Sune's update of Gpg4win to Qt 6.10.x, etc.
Indeed. We would need to add different entries to the context menu for each installation. Given that GpgEX needs to be replaced anyway and we will drop the need for a UI server socket (which is anyway only a trigger and no full communication).
Tue, Dec 9
With the product-specific standard locations implemented for T7717: Location of qt-application config files it's now longer necessary to customize the application name of Okular. Closing as wontfix.
The new approach has been implemented and backported for VSD 3.4.
All changes have been backported for VSD 3.4 (because they are closely entwined with changes for T7717).