# Friends should not be able to share VCARD but by-friend-invite-links

**URL:** <https://forum.delta.chat/t/friends-should-not-be-able-to-share-vcard-but-by-friend-invite-links/5784>\
**Category:** Feature Proposal\
**Created:** [September 13, 2026, 12:31pm UTC](https://forum.delta.chat/t/friends-should-not-be-able-to-share-vcard-but-by-friend-invite-links/5784 "2026-09-13T12:31:51Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![lucarne](https://forum.delta.chat/user_avatar/forum.delta.chat/lucarne/32/3667_2.png) [@lucarne](https://forum.delta.chat/u/lucarne)\
**Post date:** [September 13, 2026, 12:31pm UTC](https://forum.delta.chat/t/friends-should-not-be-able-to-share-vcard-but-by-friend-invite-links/5784/1 "2026-09-13T12:31:52Z")

</div>

Deltachat user A is friend with user B.

B is able to share A VCARD to new friends. This VCARD contains the public key of A, and his profile picture. This VCARD can not be revoked by A.

B should not be able to share this VCARD.

B should be able to share an invite link of A, generated specifically by B using both public keys of A and B. When a new friend C tries to contact A via the invite link shared by B :

1. Deltachat (of A) should not accept initial contact messages from VCARD, only initial messages coming from invite links.
2. Deltachat (of A) detects that the invite link used where shared by B (because signed with public key of B)
3. If A has blocked B, then the message of C is discarded and not displayed to A. It prevents spam coming blocked users who shared your invite link on the internet to annoy you.
4. If A has not blocked B, then the initial message of C is displayed to A, with an information box telling that C is contacting A through B (so, A can know C is using a invite link from B).
5. A can “reinitialize” the invite-link of B (it sends a service-message to B and both reinitialize the invite-link). It avoids spam if C leaks the invite-link but A and B are still friends.

---

<div class="post-metadata">

**Author:** ![ian](https://forum.delta.chat/user_avatar/forum.delta.chat/ian/32/3164_2.png) [@ian](https://forum.delta.chat/u/ian)\
**Post date:** [September 13, 2026, 3:53pm UTC](https://forum.delta.chat/t/friends-should-not-be-able-to-share-vcard-but-by-friend-invite-links/5784/2 "2026-09-13T15:53:22Z")

</div>

I’ve already described a solution to this here just recently. It’s basically token-based mailbox localpart subaddressing and using a unique token for each person you communicate with. This would create a unique vCard for each contact and each one would only be usable by a single peer (a single fingerprint).

> [@Option to ignore chat invites and being added to groups for a profile](https://support.delta.chat/t/option-to-ignore-chat-invites-and-being-added-to-groups-for-a-profile/5721/15):
>
> Actually, it would be quite easy to implement, but that’s probably a different feature request. Basically, your client could keep track of who you have invited to chat and who you share a group with and it could automatically throw away any and all emails that arrive coming from outside this flow (i.e., such as via a channel). A huge drawback would be that normal people couldn’t contact you via a vanilla pgp vcard either, so it’s not acceptable. A different workaround would basically boil down…