RE: Impossible to reconnect after erasing bond without manual operation

Florent243 — Wed, 30 Aug 2023 14:22:43 GMT

Hi Hung,

Thanks for your reply, it makes sense, even if, if this happen it need to be specify in keyflow and explain to final user which is not easy for non technical people.

Hope I will no need to delete bond information to avoid that case.

Thanks

Florent

RE: Impossible to reconnect after erasing bond without manual operation

Hung Bui — Wed, 30 Aug 2023 11:57:59 GMT

Hi Florent,

I think it's expected behavior. Security is the reason. This is to avoid an attacker who wants to force your device and the phone to unpair and require a new pair. He then can spoof that it's your device (by cloning the address) and pretend that it's your device that has removed the bond information. If we do what you plan to do , meaning the phone delete old bond information and make a new bond, either the attacker can bond their device with the phone, or they can at least remove the original bond on your device.

This is why it is specifically require the end user to click "Forget this device" instead of automatically making a new bond.

I don't think you can do it transparently on the app on the phone either (you can with Android, not on iOS I believe).

One option you can do if it's not possible to click "forget this device", is to switch to a new address. This way, the phone would treat the device as a new device. However, if you do that often, there will be a long list in the phone of bonded devices that end user need to remove.