Julius Joska
717aeed4ff
A stranger could pick the display name of an existing contact ("Mom")
and appear as that contact. Messages from a key that is not in the
contact list now open a message request labelled "(unknown)": no
replies, read receipts, typing indicators, calls or name in
notifications until the user accepts it and names the contact
themselves. Names that look like an existing contact (case, diacritics,
Cyrillic/Greek homoglyphs, invisible characters) also show a warning in
the real contact's chat.
When the relay account of a known contact shows up with a different
key, the chat shows "safety number changed", verification is cleared
and the session that now belongs to the other key is dropped before
sending, so a reply never goes to the new key.
Šepot — Flutter client
The Šepot mobile client. See the repository README for the project overview, threat model, and license.
Quick start
flutter pub get
flutter run # against the default relay
flutter build apk --release # signed release APK (see key.properties)
Layout
| Path | Contents |
|---|---|
lib/core/ |
Crypto facade, storage (SQLCipher), relay client + transport, push, services |
lib/features/ |
Screens (onboarding, chat, contacts, groups, settings, safety…) |
lib/models/ lib/providers/ |
Data models and Riverpod providers |
lib/l10n/ |
Localization (app_*.arb, generated AppLocalizations) |
test/ integration_test/ |
Unit, storage, crypto, and on-device integration tests |
Localization
Strings are defined in lib/l10n/app_cs.arb (template) and translated into
app_en/de/ru/it.arb. After editing, run flutter gen-l10n. See the root
README for how to contribute a new language.