pcwinters / liam Goto Github PK

Looks good in the google contacts web interface, but verify that the API doesn't have a size limit or anything and that line breaks can be encoded properly.

Dragging a private key from a USB stick, for example, on to the browser window should register the key with the javascript runtime.
The user avatar should show some indication that a key is ready to be used.
Prompt to password-unlock key if necessary.

Encrypt message text using a keyring comprised of all recipient public keys.

Determine what mechanism, if any, could be used to send and view password protected messages.
Questions to answer

• What method to use. Maybe cryptojs w/ AES with a PBKDF2 key?
• How to read messages:
  • Query strings can be ~2000 chars. Maybe we send recipient a link to our app with message in it?
  • Store messages w/ API server in Mongo?

All javascript, html, css (the entire client app) should be packaged into a single file.
The sha of this file should be published in github with the distro.
This should be the only file served.

The client app currently proxies the API app. Remove this proxy and dependency.

The client app should query the API with an absolute URL. This URL should be configured as an environment variable and transmitted to the client by embedding the JSON string of a config object in the DOM.

In Jade:

#initialState= JSON.stringify({"apiURI":"http://something"})

Send two messages when the recipient list is split by crypto support: one encrypted, the other not.
Indicate to the user what recipients will be receiving insecure email.

Reliance on the liam API should be solely for IMAP.
Google's api supports CORS

Associate entered recipients with address book entries so that public keys can be pulled for encryption.

When reading a message that happens to be encrypted, immediately initiate the decryption process with progress indication for the user.

Standard email plaintext composition, entering user email addresses

Use github.io.
Prepare a mission statement and marketing site.

Do an 'exact' search against the sks pool for a public key with the specified e-mail address.
http://sks-keyservers.net/

Google's javascript toolkit needs to go. It isn't reliably secure. Client oauth calls need to be made directly.