I'm currently writing an alternative implementation of KDE connect in Python. While going through the code, one thing that catched my attention was that `pair` type messages with `pair` set to `False` (essentially an unpair request) have no challenge or any other sort of mechanism that would prevent other devices from spoofing an unpair request. Has this just been overlooked or is there a specific reason for allowing this? Reproducible: Always
This is indeed a code bug and a security problem. We are working on a re-write of the pairing and encryption code, so we will include a fix for this in the new code. Thanks!