How to invite new user to specific server?

[Minim]

The FAQ suggests that OP step 2, preventing the automatic creation of an official profile, is needed. I don’t recall a first profile creating itself automatically. That doesn’t seem desirable, since it sends out a request to a server well-known to be associated with Deltachat.

Automatically starting an account creation wizard makes sense. Not steering quite so heavily towards the default server (for instance, by using a combo box to pick the domain) might be good for decentralization and load spreading.

[9er]

@adbenitez

it could be used to trick people into onboarding into your fishing server where you can track them

In any case there shoud be warning of what server admin can do.
Because any chatmail server can track it’s users.

[bencan]

@adbenitez

the danger I see with this is that it could be used to trick people into onboarding into your fishing server where you can track them, not sure we should support such feature, it is better that it is a more explicit action that requires the person to realize they will be onboarding on your server

That’s a valid concern, but considering Delta Chat has always stated it is designed for use between trusted friends and family, not adversaries, it seems ad hoc to include adversarial contacts in the threat model only for this specific situation.

The threat of a fishing server still exists if people follow the manual steps anyway, for example if the adversarial contact shares a QR to their fishing server, so prohibiting the use of more flexible invite links doesn’t solve the threat.

In fact the threat of fishing exists independent of which server you use. Anyone who has your contact can send you a fishing message, they don’t need to control the server you use to do that.

@9er

In any case there shoud be warning of what server admin can do.
Because any chatmail server can track it’s users.

Yes, it makes sense to apply the warning consistently.

@Minim

The FAQ suggests that OP step 2, preventing the automatic creation of an official profile, is needed. I don’t recall a first profile creating itself automatically. That doesn’t seem desirable, since it sends out a request to a server well-known to be associated with Deltachat.

Automatically starting an account creation wizard makes sense.

I don’t think @9er’s proposal is about removing the account creation wizard, it would just set a different default server for the wizard instead of nine.testrun.org. The user would still have the same level of control as they now do and could choose a different server if they wanted.

[Minim]

I think a UI that makes it easier to pick a server (by domain name) would be the easiest way to do this. Something like:

---

Profile name
(profile image, autogenerated but replacable)

Server (combo box, choose from dropdown list or type-in, or scan server-invite QR)

This is a Chatmail server, an account will be automatically generated for you.

Server policy is: autoloaded policy

[Agree and Create profile]

OR
If it is not a Chatmail server, offer options as on current “Log in with an existing e-mail account” screen.
(asks e-mail addy and password, offers show-classic-mails option and advanced manual server config) Add tickbox forcamoflaged Chatmail servers.

---

The publically-listed Chatmail servers announce to the world that they are Chatmail servers, so if the user chooses a server from the drop-down list, the UI can say “This is a Chat mail server…” and the server-specific policy can be auto-filled. Additional server info, like the host country (flag) and domain-name registrar, could also be provided.

If the server does not announce that it is a Chatmail server, there should be a tickbox to say it is nonetheless a (camoflaged) server.

The current setup has a New/Existing choice, then a Create/Other choice, and “Other” gives four more choices. This would give one page with two choices, profile name and server name, asking more info only if and as needed.

Sorry for the terrible mockup, I can draw better if there is any interest.