From 28c77b7648b2a44a18be64ec44344d91cccfd742 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Thu, 15 Oct 2026 14:25:00 +0200 Subject: feat(auth): the recovery key never reaches the hub MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ticking "also e-mail it to me" at registration sent the recovery key R in the register body, and the hub appended it to the verification e-mail: the hub saw R in clear on its way out, and the resend door — no captcha — let anyone who knew a pending username and address have the hub mail a "recovery key" of their choosing. The box is gone. The recovery screen offers "E-mail it to myself", a mailto: link that opens the person's own mail application with the key filled in; the desktop shell hands mailto: to the system (http, https and mailto only) and the Android shell to a mail application (ACTION_SENDTO). The CLI drops --email-recovery-key and prints the key, as before. The hub mails the code alone, and refuses a register that still carries a recovery_key rather than dropping it, so an older client offering the option cannot tell someone their key was sent when it was not. A mailbox holding R remains, with the reset code that reaches the same mailbox, enough to recover the account's identities; the link says so, and it is the person's choice. Checked in Chrome and Firefox (headless, the real page against a stubbed hub) and by the CLI's end-to-end registration against a local hub. The Android change was not built here, and the desktop link was not clicked in the application. Co-Authored-By: Claude Opus 5.5 --- packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js') diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js index 0ef354e3..42c56f01 100644 --- a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js +++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js @@ -75,9 +75,11 @@ export default { 'register.recovery_warning': '如果您同时丢失了密码短语和此密钥，您的文件仍会保留在各自的节点上，但您将以新身份重新加入每个群组。', 'register.recovery_saved': '我已将恢复密钥保存在安全的地方。', 'register.recovery_continue': '继续', - 'register.recovery_email_opt': '同时将此恢复密钥通过邮件发送给我作为备份', - 'register.recovery_emailed': '副本也已发送至您的邮箱，与验证码在同一封邮件中。', - 'register.recovery_not_emailed': '这未通过邮件发送。请立即保存——它只显示这一次。', + 'register.recovery_mail_self': '通过邮件发给自己', + 'register.recovery_mail_hint': '打开您自己的邮件应用并填好密钥。它不经过 hub；任何能读取该邮箱的人都能使用它。', + 'register.recovery_shown_once': '请立即保存——它只显示这一次。', + 'register.recovery_mail_subject': 'MeshBay 恢复密钥', + 'register.recovery_mail_body': 'MeshBay 账户 {user} 的恢复密钥：\n\n{key}\n\n如果您忘记密码短语，它可恢复您的群组身份。请勿将此邮件透露给他人。', 'register.success_title': '验证您的邮箱', 'register.success_msg': '验证码已发送至您的邮箱。请在下方输入以激活账户。', 'register.go_login': '前往登录', -- cgit v1.2.3