Android 0.8 — sign-in identity, v3 responder, media scrubbing #35

2026-09-01T22:06:26Z

paulhitt commented

2026-09-01 22:06:26 +00:00

(Migrated from gitlab.com)

9 commits from 2026-09-01. This is the branch Android 0.8 was built and
published from, so main currently does not contain shipped code.

Sign-in minted a new identity instead of loading the stored one. It consulted only the
in-memory field, which sign-out clears — so the phone became a different device on every
sign-in, contacts were asked to accept keys that had no business changing, and the account
accumulated a registered device per sign-in. Fan-out is per device, so half of everything
sent went to a mailbox nobody read.

A session we ANSWER can now be v3, so the post-quantum ratchet applies in both
directions rather than only when this side initiates.

Two sign-out doors, and updatePassword no longer takes the destructive one — changing
a password used to erase the phone and make you a new device to everyone.

Story photos and videos are scrubbed: photos through ImagePrep, videos remuxed with
MediaExtractor/MediaMuxer to drop container metadata including capture location. A
failed scrub refuses the post rather than sending the original.

Protocol traffic marked silent so the relay stops announcing call answers, delivery
keys and log gossip as new mail.

9 commits from 2026-09-01. **This is the branch Android 0.8 was built and published from**, so `main` currently does not contain shipped code. **Sign-in minted a new identity instead of loading the stored one.** It consulted only the in-memory field, which sign-out clears — so the phone became a different device on every sign-in, contacts were asked to accept keys that had no business changing, and the account accumulated a registered device per sign-in. Fan-out is per device, so half of everything sent went to a mailbox nobody read. **A session we ANSWER can now be v3**, so the post-quantum ratchet applies in both directions rather than only when this side initiates. **Two sign-out doors**, and `updatePassword` no longer takes the destructive one — changing a password used to erase the phone and make you a new device to everyone. **Story photos and videos are scrubbed**: photos through `ImagePrep`, videos remuxed with `MediaExtractor`/`MediaMuxer` to drop container metadata including capture location. A failed scrub refuses the post rather than sending the original. **Protocol traffic marked `silent`** so the relay stops announcing call answers, delivery keys and log gossip as new mail.

paulhitt commented

2026-09-01 22:09:25 +00:00

(Migrated from gitlab.com)

mentioned in commit fa925819d2

mentioned in commit fa925819d220d47476387100b1a7cb349ef7e4ea

paulhitt (Migrated from gitlab.com) merged commit fa925819d2 into main

2026-09-01 22:09:25 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: extant2000/flamenet-messenger-android#35