datavaccinator / vaccinatorjsclient Goto Github PK

The WebCryptoAPI is also able to do SHA256. So we might use this instead of the forge-sha256 include.

Maybe combine this job with work for enhancement #1.

Currently, the publish() function also validates the maximum duration range (365). As this is already done by dv-vault and it may change there, we should not do in the JS lib.

Only check for < 1 but not for the maximum.

Currently, the search hash is built like this:

• Hash the word character by character
• Add random bytes to the generated hash

The drawbacks are:

• False positive hits during search for words with the same beginning and random matches
• The entropy for the word length is only added by max 3 characters

As a suggestion, we might build the hash like this:

• Add a NULL byte to the word
• Add random bytes to the word until it reaches the size of 16 characters. Use 32 if the word is longer than 16 characters.
• Hash the word character by character

Benefits:

• Enhanced entropy for the words
• Impossible to predict anything by the length of the search hash (all 16 or 32 bytes)
• Eliminate possible false positives during search

If changeAppId() is used, the existing search index is getting destroyed because the update call with the newly encrypted data does not submit new searchwords.

To fix this, in vaccinator_api.js -> changeAppId(), the newVac instance needs to get newVac.searchFields set to the value of that.searchFields (similar to newVac.setHeaders(that.headers);).

We should replace the localforage library with direct IndexedDB access.

See here for additional details and a possible start:
https://developers.google.com/web/ilt/pwa/working-with-indexeddb

Note: Brosers which do not support IndexedDB will not be able to run the DataVaccinator JS class then. The localforage library switches to another database schema in the backend automatically. This will be gone then!

In order to replace the dependecy to aes.js, we might replace this by using WebCryptoAPI (https://www.w3.org/TR/WebCryptoAPI/). Sadly, IE11 is still not fully implementing the standard yet (not using promises).

In the enhanced dv-vault function check, the dv-vault will return maximum values:
DataVaccinator/dv-vault#8

We should respect them and check for these limits before uploading stuff (faster, less bandwidth).

This class is setting uid to the user-identifier automatically.

There should be an optional parameter for the request to set a uid parameter (like new, get, update etc).

If someone already relies on the uid to be set with the user-identifier, they would have to adapt their code to always provide that value in the calls.