Possible vulnerabilities in key generation, IV and MITM about discord-encryption HOT 4 OPEN

I have just added the Apache 2.0 License

from discord-encryption.

I appreciate the commitment to security in pointing all these issues out, however, this plugin is experimental, if you are looking for a genuinely secure messaging I would recommend Signal.

In addition to being experimental, this plugin is also open-source, if you are eager to see those features, you are more than welcome to submit a PR 🏋️‍♀️.

from discord-encryption.

Thanks I will fork.
What license does this project run under? I have not found a license

from discord-encryption.

Ah btw if you try to install and start the plugin it isn't working because it expects some JSON which hasn't been created yet.

[encryptionPlugin] Error parsing local storage SyntaxError: "undefined" is not valid JSON
    at JSON.parse (<anonymous>)
    at getUserData (encryption.plugin.js:17976:25)
    at new Encryption (encryption.plugin.js:18411:37)
    at M.initializeAddon (renderer.js:4:34235)
    at M.loadAddon (renderer.js:4:8506)
    at M.loadAddon (renderer.js:4:33490)
    at M.reloadAddon (renderer.js:4:9211)
    at _t.reload (renderer.js:4:360780)
    at <anonymous>:1:22

I had to create dummy data manually and then set a real password to make this work :D

It's this line in storage.ts

const getUserData = window?.BdApi?.getData(config.name, config.name);

Just add a sanity check if !getUserData then leave the trycatch block and return the default data

from discord-encryption.