I’ve created a Delta Chat account only a few days ago and only shared an invite in private with exactly 6 people, to test Delta Chat with them.
Today, I’ve received a chat request from a totally unknown person which definitely looks like spam (Uganda person in the nutrition sector trying to make international friends. I’ve no contact in Uganda and I’m not related to the nutrition sector in any ways).
My questions are:
How could that person send me an invitation while my profile is supposed to be 100% private?
Is that kind of spam a known problem? Or am I a one-off?
To be complete, I should say that I opened a public channel which gained more than 100 followers. But my understanding was that people could not contact me directly even if they followed the channel.
No, such spam is not common nor feasible under DC, unless one of your friends is trolling.
However, if by public channel you mean you have joined a private Delta Chat group, then yes, any other member can then spam you. Otherwise not if you were using broadcast channels (but you would not know the subscriber count of that I guess, so that’s probably not the case).
Are you using a chatmail relay or a classic mailbox? Is receiving only encrypted messages (the default) enabled under your relay configuration?
A friend told me that there’s a way to contact me through the public channel : click on the bubble of a post then you see the profile of the poster and you can send a message.
This is highly problematic as it prevents any high profile person to open a channel through Delta Chat. Should I report this as a bug?
Please use the correct terminology. A private group (that you are only supposed to enter either with friends or a new, throw-away profile) is where everyone can send messages.
A public broadcast channel is a one-way subscription that shares news with you is safer, such as:
XMPP has the distinction that a pseudonymous MUC (group) can either allow or prohibit a member to direct message another member. This is more of an exception than the law as other messengers such as IRC, Matrix and Slack lack such a feature.
It might be feasible to implement new group metadata or even user setting that could signal whether reaching others through shared groups would be allowed or if a new personal invite would be needed for each conversation. However, this would require major changes and also make initial contect awkward.
If the user posted their invite link to the shared group chat to get in contact, everybody could again click on the link, so a different kind of introduction system would be required for the common use case of taking discussions to private.
How do you know the number of subscribers? You see, when you subscribe to a public broadcast channel, you only get into contact with the channel owner, while if you join a private group, you exchange contacts with everybody else instantly. Surely the channel owner could also be malicious hypothetically, but the chance for that is smaller.
That was an important piece of information to omit. As mentioned above, yes, the channel owner will exchange contacts with each subscriber so that they can send messages (and subscribers can also unsubscribe or reply with reactions in private in ArcaneChat for example). Hence why a channel owner ought to create a new, throw-away profile for this purpose.
I hate that word but, in my niche, I’ve earned some recognition. So, yeah, I understand that my usecase could be quite rare on the still young Delta Chat.
I’m not gonna answer the whole thread because it kinda derailed in some answers but I see the problem
First of all, spam is not possible. But also yes, being a channel owner means connecting with the followers. I actually like this because Telegram added answer to the admin only after a lot of years, we get to get it since day 1 of channels instead!
But as you say, that can be problematic in some scenario.
My solution that apply to my channel is pretty simple: I have more than one profile! I should probably post about my setup one day.
Anyway, yes just have a profile dedicated to that channel and mute notification from that profile. The one profile fits all model is not “smart” on delta, because it would defeat some of the purposes. I have a profile for the link on my mastodon account, basically it’s public and I would never want to have a public link for everyone on a personal account for my family and friends.
It should also be written somewhere in the docs that the smartest way to use delta is to have different identities
I give my contact link (the link contained in the QR code) to someone. This person can use this link to add me on DeltaChat. AND he decide to publish this link on the internet (without me knowing). => I will start to receive unsolicited contact requests from strangers.
=> I can block these strangers, AND
=> I can decide to re-generate a new QRcode contact link to stop future requests coming from the first contact link.
Second situation :
I give my contact link to someone. This person then share my VCARD contact on the internet (he use the “share a contact” feature in DeltaChat, then he export the shared VCARD and publish it on the interne) => I will start to receive unsolicited contact requests from strangers.
=> I can block these strangers, AND
=> … I can NOT regenerate a new VCARD, or can I ??? Meaning I will continue to receive everyday contact requests from strangers, until I decide to delete my account.
=> If I success to find the friend who leaked my VCARD, I can block him in Deltachat, but it will not block the validity of the leaked VCARD. So I will continue to receive requests from strangers, until I delete my account.