Impersonation

[JakubVanek]

Users can convincingly impersonate other users by sending a multiline message with the same markup that Wormhole would add, e.g.

is one multiline message sent by the "blue" user that also looks like a message from the "green" user.

[JakubVanek]

Icons mitigate this slightly, but only partially:

If some server connected to Wormhole includes the emote that Wormhole uses for the server, the look-alike protection is gone.

[JakubVanek]

#28 perhaps addresses this.

[ArcasCZ]

Do you have any suggestion on what to do with this, except the moderation tools? 🤔

[JakubVanek]

I unfortunately don't have a good solution to this. Here are my ideas (most of them probably unrealistic):

• Detecting the impersonation by parsing messages may be hard to do correctly, i.e. **[server a] user:** and **[server** **a] user:** render the same. Emote name also likely cannot be used for detection. "Funny" stuff like zero-width spaces may also interfere with the detection (although it might be possible to somehow filter these out).
• Replacing every \n in a message with \n.... or \n would stop this, but it would also break quotes and code blocks
• Dropping newlines (i.e. replacing \n with empty strings) has the same problems
• Somehow stripping all markdown (including bold) would also fix this, but it would provide an even worse UX

[JakubVanek]

Hmm, maybe the replacement of \n with \n.... could be disabled within code blocks and quote blocks by parsing the markdown text, but parsing markdown could add quite a bit of (possibly unwarranted) complexity.

[JakubVanek]

Unfortunately newline stripping may not be sufficient, because

a ``` b ``` c ``` d ``` e

renders as

so a newline can be created without actually using \n