Solved an issue with corrupted exchange keys

From time to time, we receive a ticket from a user who is unable to invite another user, because the recipient can not see or accept the invitation. I have tried to replicate this issue without success, so my workaround has been to manually delete the invitation from the database so that the two users can restart the process. Generally this worked.
The strange thing was that the problem was repeating always within the same teams. As you know, Passpack has been built to be personal and private. So the best practice, in any case, is that one user access one account. If more than one user accesses the same account, this can create unpredictable problems.

A pratical example

We have three users: Bob, Alice and John.
  • Bob accesses his personal account (good!). Instead Alice and John access the same company’s account (bad!).
  • Alice invites Bob.
  • Before Bob has a chance to see the invitation, John checks for updates. The system finds a request for exchanging keys that is related with his current account (that Alice is also accessing, remember), elaborates the keys and delete the original RSA-encrypted keys for security purposes.
  • When Bob checks for updates he finds the invite, but the system is not able to generate its own keys because the original keys have since been removed.
  • The result is that Alice has invited Bob, but Bob can not see or accept the invitation because the exchange keys are bad.

How to fix the issue

When I discovered this practice I finally understood what was causing the key corruption. So I’ve added a more sofisticated control to avoid the problem. But, since it is impossible to propagate a change to previous versions, it was necessary that all the involved users reload their Passpack page to have the latest version of the application. If not, the invitations may seem correct but the user will not be able to see any shared entries because his keys are not compatible with the current keys of the sharer.
If you are experiencing a problem with invitations or with users that can not see any shared entry you should follow these steps:
  • Be sure that you have the latest Passpack version (logout and reload to be sure)
  • If you have tried to exchange secure messages with the user, delete all those messages and ask the other user to do the same
  • From the People tab delete  the invited user
  • Ask the other user to press their check for update button to verify that there aren’t any invitations from you
  • Invite him again

If you have any issues please open a support ticket.

2 Comments

  1. Thanks! :)
    Keep up the great work guys!

  2. Francesco

    There was a user that recently tried to follow the instructions and complained that it didn’t work. The problems was that he had exchanged a secure message with the other user. In this case, Passpack doesn’t delete the invitation because this would cause that you would’t able to read the existent messages. But in your case, if you experience the issue reported in this post, you need to reset the keys. This is why it is absolutely important that you delete any messages exchanged with the other user.

Leave a Reply