Gryt 1.12.0
Direct messages on the desktop and the web now use MLS, so a key that leaks later can't open messages from before it leaked. On a reconnect, the app also waits for the server to prove who it is before sending your sign-in token.
Security
- Security
When the app reconnected to a server, it sent your sign-in token, and anything you'd sent while offline, before the server had proved who it is. Uploads, avatars, emoji and other requests with the token didn't wait at all. Only the first connection waited. Now every connection and every request with your token waits for the proof.
Chat
- New
One-to-one DMs are end-to-end encrypted with MLS once the other person has an app that can do it. Every message gets its own key, and your device deletes it after use, so a key stolen later can't open what came before. It needs a server on 1.10.35 or later. DMs from before keep opening the way they did.
- Changed
Your MLS messages are kept on the device that read them. On the web that's this browser, and clearing its site data deletes them. A new device starts with nothing from before it joined, and your 24 words don't bring that history back.
Someone on an older app sees "Update Gryt to read it" in place of each MLS message. Once a DM has moved to MLS it stays there.
Reactions, reports and link previews are off for MLS messages for now. The server has no copy of the message to attach them to, and making a preview would show it the link.
Servers & invites
- Fixed
A server that restarted within five seconds of you connecting got refused as if it had stopped proving who it is, and Gryt stopped reconnecting to it for the rest of the session. That's fixed. The blocked entries it left under Server identity in Settings are cleared once when you update.
Settings & app
- New
If your keychain won't let Gryt open the messages it keeps on this device, the DM and Settings > Security say so, with Try again. There's also Clear local history on this device, which starts this device over with new keys.
Self-hosting
- Changed
The server built into the desktop app is updated to 1.10.37, which passes MLS messages between devices.
There’s a post about this release: Direct Messages Now Run on MLS.