aiman-al-masoud / chatnip Goto Github PK

The way things are now is:

the RSA public-private key-pair is generated solely from the user's password. Which means that any potential attacker that knows user A's public key, and user A's password, is able to infer user B's password if B has the same public key as A.

you must pull the public key of the sender from the server and compare it to the public key in decryptionRes to complete the verification of the sender. Right now it only
checks wheather sender had access to ANY keypair, not necessarily the one
corresponding to the public key listed on the server as the sender's.