neotsn / warbler-app Goto Github PK

• Test that the verification works if you have the public key.
  • Figure out how to get the public key later.
• I need to understand what "validation" means. It may just mean that you can verify the signature is signed by the person who owns the corresponding private key with that email address.

• If user unauthenticated, send to login page
  • Design Login Page
  • Fix the main layout of App to be responsive for mobile
  • Test authentication on mobile.
  • Resolve popup window persisting
• If user authenticated, check for existing keys
  • If no keys, send to PGP Stepper/wizard
  • If has keys, send to Twitter Status Poster

• Create the directory for warblerapp.com
• Get some files up to the server
• Run systemctl reload apache2
• Rerun the certbot command to include warbler.
• Serve warblerapp.com from the tsn server
  • See https://stackoverflow.com/questions/9831594/apache-and-node-js-on-the-same-server
• Add https to the express configuration
  • See https://www.sitepoint.com/how-to-use-ssltls-with-node-js/
• Use Certbot for the TLS

• Generate and store a key
• Sign a tweet with the key
• Review the output, without posting to twitter

https://gaevoy.com/2019/05/10/pgp-signature.html

-----BEGIN PGP SIGNATURE-----

wnUEARYKACcFgmQYuNcJkCp6kfitPstEFiEEpX+rsiSlBmpzt4MBKnqR+K0+
y0QAAJWoAQCpzC3YkCmCUFIp134F+qIROwWmmGCtjGS3Jt73l+IZiQEA2gwK
YnqYXyLPDGsIov5Xtm0yVHdDMpEQ02/Rmxm5sAU=
=zeVy
-----END PGP SIGNATURE-----

c2 75 04 01 16 0a 00 27 05 82 64 18 b8 d7 09 90
2a 7a 91 f8 ad 3e cb 44 16 21 04 a5 7f ab b2 24
a5 06 6a 73 b7 83 01 2a 7a 91 f8 ad 3e ff fc b4
40 00 09 5a 80 10 0a 9c c2 dd 89 02 98 25 05 22
9d 77 e0 5f aa 21 13 b0 5a 69 86 0a d8 c6 4b 72
6d ef 79 7e 21 98 90 10 0d a0 c0 af ff 62 7a 98
5f 22 cf 0c 6b 08 a2 fe 57 b6 6d 32 54 77 43 32
91 10 d3 6f d1 9b 19 b9 b0 05

• Verify the length of the tweet + delimiter + signature

Tweet Signature Flow

• User writes as much content as they want into the field
• On Submit, sign entire message string
• Generate, compress, and b64 encode the "signature + text + pubkey" payload
  • See https://www.geeksforgeeks.org/node-js-zlib-gzip-method/
  • Pass error handler down into pages
  • Pull twitter logic up into Feed component.
• Append payload to Warbler Verification URL
• Prepend the string with 🔑 https://warblerapp.com/verify/12345678931468 ➡️ (30 Chars)
• Append the string with: ⏹️ 🔑 (6 chars)
• Process the string into separate tweets
  • See https://getchirrapp.com/

• Display the resulting tweets on the page as a preview
  • Come up with a way to fake a 23-character t.co url during preview?
  • Pull enough user data from login to populate fields:
    • Name, username, verified?, private?, image
  • See https://zorapeteri.github.io/react-tweet-card/

• Automatically upload the public key to a public store that can search for keys by "email address" or in this case screen name.
• Store the Key Fingerprint in local storage
• Add the Fingerprint some where? We need to be able to consistently fetch it from the Twitter Profile to verify any given tweet from the client-side on another client.