Clone profile for best-effort rotating of your compromised identity

Scenario:

  • If you had accidentally joined a public group of untrusted individuals with your private main profile or an untrusted individual distributes your contact card without your consent.
  • If a third party had gained access to your private key (via a backup file, device physical access, malware or by accidentally adding the wrong device as a secondary).

Clicking an emergency button in the settings locally (or via the remote wipe mechanism) would accomplish the following:

  • Duplicate and fork the old account to old-1 that you synchronize across your devices and old-2 and old-3 that you do not
  • Remove all relays from old-3 and create a primary relay address
  • Create a new profile (at a fresh relay account with a fresh key pair)
  • Copy all user preferences (except credentials) and public fields from old-1 to new profile, such as name, bio, avatar, read receipts and theme
  • Generate a direct chat invite link to the new profile
  • Send invite link and a short template explanation (urging to verify out of band) to each contact using old-3 except to those who the user deselects
  • Add new profile as member to each group old-3 is a member of except to those which the user deselects
  • Post a short template explanation to each group with old-3, hopefully everyone should be aware of the modified primary relay address by now
  • Leave all groups with old-1
  • Back up all past messages on old-2 and import (in possibly slightly altered form) to new profile to mostly retain chat log
  • Clear and delete all groups and chats with old-1 to hopefully affect secondary devices coming online later
  • Remove all relays from old-1 and create a primary relay address for it (that hopefully nobody will know about) and ensure to never send any messages from it
  • Continue to monitor old-2 for a few months and if you catch messages from others, import it to the chat log of the new profile and reply with control messages from old-3 to update the relay address and leave groups

This is a convenience feature similar in spirit to clone chat in that it will not protect against targeted attacks:

  • The attacker discloses your private key to all of your contacts and groups or publicly.
  • The attacker overtakes some of the relay accounts you had used previously.
  • The attacker clicks the Clone profile button sooner than the original owner.

I found existing issues revolving around similar problems overly verbose, less focused and and not actionable:

I am not sure I am following the details here, but I support the general idea. If the attacker does not have the relay login password(s), this could be used to protect the account(s).

1 Like

We would be in a little better situation if relay passwords could be changed also, but this is just adhesive bandage anyway.