From 3131630d900aa4a72bf880bfa9c5232bff64d6d6 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Wed, 14 Oct 2026 23:02:49 +0200 Subject: fix(client): link a device from the application; approve one match only "Get a linking code" called the connection the page had just closed on the node's unknown_device refusal, so it never filed anything. It now retries with the request filed on that connection, before the proof (MNP 6.3), and the page tries the group again after each refusal until a linked device approves the code. Offered only in the desktop application: a browser's minted identity is gone by its next connection. Approving refuses a code that matches more than one pending request: filing needs only the account's token, so somebody holding the passphrase who saw a code could file their own keys under it. Co-Authored-By: Claude Opus 5.5 --- docs/MESHBAY_DESIGN.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'docs/MESHBAY_DESIGN.md') diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md index 6dd1b2e..49baa6a 100644 --- a/docs/MESHBAY_DESIGN.md +++ b/docs/MESHBAY_DESIGN.md @@ -283,7 +283,11 @@ new_pk_x25519)`. The approving device asks the node for this account's pending requests **with their stored hashes** and recomputes the hash for each until one matches. **An approval answers a pending request**: it names the request's hash, and the node admits the keys only if that request was filed by those same keys. A -countersignature alone — however it was obtained — admits nothing. Retiring a +countersignature alone — however it was obtained — admits nothing. **A code that +matches more than one pending request approves none**: filing needs only the +account's token, so somebody holding the passphrase who saw the code could file +their own keys under it, and the first match would then be whoever filed first. +The new device shows a new code instead. Retiring a device is signed under a prefix of its own, never the admission transcript: a signature given to retire a key would otherwise admit it. -- cgit v1.2.3