Scanning a vcard QR-code should use the PGP key for E2EE

[ian]

Scanning a QRcode that contains a vcf with all required properties (version, email, fn, key, rev) results in DC trying to initiate contact through unencrypted plaintext email. This is blocked by chatmail.

However, if i scan the QR_code with an external barcode reader app, save it to a file, send the file to the saved note chat in DC and then click on the uploaded file (contact button), it does initiate encryption correctly!

I couldn’t find a duplicate for this issue, but some are loosely related in the same topic:

Additionally keep static qr codes for offline out-of-band verification?

The advantages: works offline (for people who do not have a mobile data flatrate) The QR codes could even be printed on visiting cards or similar The disadvantages: Actually only one direction is verified (if Alice scans Bob’s code, A can be sure that she chats with B. - But Eve could scan B’s code and do as if she was A without B noticing). So, B can’t be able to add A to a verified group. B could ask A whether the verification worked and then be sure that he chats with A but DC won…

Release the basic QR-Code "contact scanning" feature independently

@r10s, who wanted to have this discussed here: Two things to improve for releasing a basic version of the current QR-Code “contact scanning” feature from the current “lab code”: Show the own QR-Code during QR scanning. Keep the scanner running after a successful scan, to allow further scans (by the other side to let both sides add the OOB contact data, or scan further contacts in a group meetings). Advantages: solves usability issues with current code have a basic, classic “two-way” contac…

Import and use of existing GPG Keys

Expected behavior Import and use of existing GPG Keys Actual behavior Connot import my GPG Keys Example Images

Make it possible to manually import PGP keys

Expected behavior I should be able to click on a public key that is sent to me via delta.chat and see this key getting imported. Actual behavior I see the file in the message that is being sent to me but I cannot import the key manually. When I click on it, it gets opened in a text editor. I’m using delta.chat on Android. My understanding is that ideally I would not need to do this manually. However, my chat partner uses an email client without autocrypt and so sent me his key as an attachm…

Mention offline data in QR and links

Judging by the frequency at which it is explained on the forums, there is a user-expectations problem: people don’t expect a QR code to contain anything except a link to a webpage. They certainly don’t expect a web link to be a data format as well as a link to the webpage. One could put a note under the QR code and link. Something like “You can open this link offline in Deltachat” That might be a hint that the code and links aren’t just web links.

The life-changing magic of WKD

I just found out about Web Key Directory, maybe Delta Chat could use that as a method of key discovery in addition to Autocrypt? It can’t replace Autocrypt since WKD needs to be implemented server side whereas Autocrypt adds e2e to any mail server.

Here is an example vcard:

[r10s]

yes, that would be cool to support KEY: field when copying a vcard to the QR code.

however, it seems not to be a priority currently as (1) Delta Chat does not created these QR codes - nor does any other apps i know of and (2) while the space fits for ECC keys, it will not for longer keys, as RSA or PQC - so we probably do not want to push for that usecase too much.

still, if it is easy to add (esp. as keys in vcards are already supported), it might makes sense

[ian]

1. Indirection could also be supported such that the QR could be a single HTTPS: URL pointing to the vcard file on the website of the person who own the given business card. The URL opens in a web browser, the browser downloads the vcf file according to disposition, the vcf mime handler intent can open the contacts app (or Delta Chat itself) with this downloaded file. Such a file could be of any length.

2. For longer encryption keys, a more efficient QR-aware encoding scheme could reduce the number of bits strictly necessary.

3. The KEY vcard property encodes an URI that can also point to a remote resource via FTPS or HTTPS, similarly to many other properties. This could even point to the existing WKD path for services offering that, or to just a static file hosted on the chatmail instance.

4. The remote filename might encode the fingerprint if immutability is desired or that could be encoded in a separate OPENPGP2FPR link in the URL property.

5. Each vcard may contain multiple KEY properties. Thus, a smaller encryption key may be included inline for emergency use while a more secure one may be referenced by its remote URL.