Skip to content

Channel name from an invite link's b= parameter is never reconciled with the channel's actual name #8250

@bolstad

Description

@bolstad
  • Operating System (Linux/Mac/Windows/iOS/Android): Mac
  • Core Version: 2.49.0
  • Client Version: Delta Chat Desktop 2.49.1

Expected behavior

When joining a broadcast channel through an invite link
(https://i.delta.chat/#...), the channel should be displayed with its
actual, current name: the same name the channel owner and every other
member sees.

Actual behavior

The device that opened the invite link permanently displays the name that
was embedded in the link's b= parameter.

If that value does not match the channel's current name (e.g. the channel was
renamed after the link was generated, or an older link was shared), the joining device
keeps the wrong name forever - even after it has received messages and membership
events from the channel.

This happens only on the device that opened the invite link. The
channel owner and all other clients display the correct name.

In the attached screenshot the channel is shown as "Knarkcentralen" both
in the chat list and the chat header. That string is exactly the b=
parameter of the invite link used to join the channel — not the channel's
real name:

https://i.delta.chat/#0D6A9C5D3E3DB037A352126C2EA02AFD2A77C33F&v=3&x=4KRXxEZVkaYMEmBqeID703kf&j=An4lktezRohvANysQdthJs3G&s=2Zjt9QxxSf68vl1uSqLfM1eg&a=p4r768hc7%40mailchat.pl&n=dekaminki&b=Knarkcentralen

The device has clearly received channel traffic afterwards. The info
messages "Du anslöt till kanalen." ("You joined the channel") / "Medlemmen … togs bort av dekaminski." ("Member was removed by dekaminski") are visible, yet the name was never corrected.

Steps to reproduce the problem

  1. Device A: create a broadcast channel and name it Channel A.
  2. Device A: generate an invite link (QR code → Show QR Invite Code → Share).
    The link now contains b=Channel%20A.
  3. Device A: rename the channel to Channel B.
  4. Device B: open the invite link from step 2 and join the channel.
  5. Device A: post a message in the channel.
  6. Device B shows the channel as Channel A, while Device A and all
    other members show Channel B.

The mismatch is also reproducible with any invite link whose b= value differs from the channel's current name.

This can be used in several ways for impersonation & phishing attacks.

Screenshots

Image

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething is not working

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions