Repository navigation
System Features
All known users using this system is displayed on the Status Bar on the right with their current status (Online, Busy, Away, Offline).
This is automatically refreshed every 10 seconds.
Private Messages are sent to each other using asymmetric key encryption. This Means only the intended receiver is able to decrypt the information. Even if the message is compromised the data is useless without the private key to decrypt it.
All messages also have a signature attached to them. This can be used to verify the authenticity of the sender to prevent and forgery. The signature is checked against the central database.
😀😀😀😀😀😀😀😀😀😀
Messages have the option of being sent to everyone or just a specific person. Private messages are also sent to everyone but due to the encryption, only the intended receiver will be able to see it.
By sending to everyone that is online instead of just the intended receiver was done so that even if the receiver is offline, they will have a method of getting the message next time they are online (not currently implement on this particular version). Essentially everyone has a copy of all the messages however only the intended receiver will open it.
Because we are sending to everyone online, the bottleneck is waiting for a response from the client. The current system utilizes threading to speed this up.
All the broadcast messages, private messages, and list of users refresh automatically on the page using Javascript without the need to refresh the page.
API keys are used for authentication instead of using BASIC http and passing the user password along every time a request is made.
Using SQL database and javascript exposes the possibility of being attacked with HTML or SQL injections. SQL is done using querying, and javascript manipulates HTML using DOM instead of string building which prevents injection attacks. Incoming data are also scanned for HTML code and appropriate HTML escaping is applied to further minimize the risk of injections
note:A small amount of JS code is still left with string building due to time constraints. This should still be caught with the HTML escaping code and poses no obvious issue.
Due to the encryption of private messages, the client needs a way to transfer the private key between different machines. Otherwise, the user will not be able to see their previous messages. We've encrypted the private key along with other useful private data such as lists of favourited and blocked words/ users using symmetric encryption and another set of a private password. This allows the user to use different versions of the client seamlessly without losing access to messages.