micheal-swiggs / jumblar Goto Github PK

Make it possible for users to easily include jumblar into their projects via maven.

For example, Jumblar may not be able to connect to MIT key server to get encoded pgp comment. So make it possible for user to simply paste the comment, coordinates, password, etc themselves and return HashBase info.

Problem identified with bitcoin RNG.

http://permalink.gmane.org/gmane.comp.bitcoin.devel/2714

http://bitcoin.org/en/alert/2013-08-11-android

Consider looking at their solutions.

Password generation should be based on SCrypt. A captured password will leak information about the HashBase.

Currently for a <username, email> pair there can only be one entry securely uploaded to the pgp network. For example a user could register multiple Jumbles for a <username, email> pair. Currently Jumblar only uses the very first registered Jumble.

It would be useful if a Jumble could be revoked. So encrypt the private key with the Jumble and upload the private-key in the comment. Any subsequent Jumble can contain a decryption of the private key which would form a link between old and new Jumbles.

http://chat.stackexchange.com/rooms/9708/discussion-between-kurent-and-ricky-demer

Currently the 'secret-data' used by the scrypt function is a byte array of the secret location concatenated with the user's master password. It maybe better to hash the location and then concatenate the user's master password....