1. 31 Jan, 2014 2 commits
    • JC Brand's avatar
      5406df1b
    • JC Brand's avatar
      Bugfix. Updates #111 · 8232cdaf
      JC Brand authored
      When using OTR with prebind, the user password isn't defined.
      =============================================================
      
      When not using prebind, the user password is used to encrypt the private key
      for the OTR session before it's saved in session storage.
      
      When using prebind, we ideally want to use the same OTR private key across page
      loads, so that we don't have to spend the time generating a new one together
      with AKE on every page load. To do this, we need to store it somewhere, like
      the browser's session storage.
      
      However, I have yet to find a secure way to store the OTR private key that does
      not expose it to maliciously injected javascript.
      
      For now, I've updated the code to generate a new private key and do the AKE
      with every page reload.
      
      I'm considering adding code to store the private key in Session Storage and
      letting the user explicitly enable this (while making them aware of the risks
      involved).
      8232cdaf
  2. 30 Jan, 2014 2 commits
  3. 28 Jan, 2014 2 commits
  4. 29 Jan, 2014 2 commits
  5. 28 Jan, 2014 2 commits
  6. 25 Jan, 2014 1 commit
  7. 24 Jan, 2014 1 commit
  8. 22 Jan, 2014 1 commit
  9. 15 Jan, 2014 3 commits
  10. 08 Jan, 2014 2 commits
  11. 07 Jan, 2014 1 commit
  12. 01 Jan, 2014 1 commit
  13. 26 Dec, 2013 2 commits
  14. 18 Dec, 2013 7 commits
  15. 17 Dec, 2013 2 commits
  16. 16 Dec, 2013 6 commits
  17. 15 Dec, 2013 3 commits