Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Double bridging allows impersonating users by having same MXID applied to two users #456

Open
Mikaela opened this issue Jun 11, 2017 · 1 comment
Labels
T-Defect Bugs, crashes, hangs, vulnerabilities, or other reported problems.

Comments

@Mikaela
Copy link
Contributor

Mikaela commented Jun 11, 2017

Steps to reproduce and screenshots below, why are they both @freenode_mikaela[m] instead of @freenode_Michaela:matrix.org which is the real IRC nick of @mikaela:disroot.org?

  1. @Mikaela:disroot.org sets nick to Michaela and joins #disroot:disroot.org and #freenode_#disroot:disroot.org
  2. Freenode user sets their nick to mikaela[m]
  3. @mikaela:disroot.org says something at #freenode_disroot:matrix.org and mikaela[m] something at freenode.

#disroot:disroot.org

screenshot 40

#freenode_#disroot:matrix.org

screenshot 41

ircs://irc.freenode.net:6697/#disroot

screenshot 42

@kuzetsa
Copy link

kuzetsa commented Jun 11, 2017

As per RFC1459, a valid IRC nick ALWAYS begin with a letter (A-Z a-z), followed by:

  1. -
  2. [
  3. ]
  4. \
  5. `
  6. ^
  7. {
  8. }
  9. 0-9
  10. letters (A-Z a-z)

Since special characters will never occur at the beginning of a nick (assuming RFC1459 compliance) using [m] as a prefix rather than placing it at the end could 100% prevent ambiguity.


Edit:

Actually, what I said is false. starting a nick with [m] or nearly any other special character-type prefix is valid, it turns out. Only certain things aren't valid at the start of a nick.

I think my original point may have been - why does the IRC protocol-side nick need to contain these [m] or whatever in the first place? It is unclear why these prefixes / suffixes exist at all on the IRC protocol-side of things.

@kegsay kegsay added the bug label Jun 26, 2017
@justinbot justinbot added T-Defect Bugs, crashes, hangs, vulnerabilities, or other reported problems. and removed bug labels May 13, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
T-Defect Bugs, crashes, hangs, vulnerabilities, or other reported problems.
Projects
None yet
Development

No branches or pull requests

4 participants