Creating a new group sends an empty group update to each recipient. On the receiving side the group creation message is currently rendered as an empty message bubble. It should instead be rendered with a css class denoting/styling it as a control message and should include some appropriate informational copy such as "[sender] added you to [group name]".

There's a few js-deps files that are larger than they need to be that I used for debugging, but could be minimized so that we have fewer files.

Hi everybody,

I talked with Frederic this weekend and he told me you were building a web version of TextSecure. I see that you have already started discussing about picking a front-end framework. I have added a response and I'd love to contribute. I have experience in front-end development (Angular, Ember). Let me know how I can help.

Our webcrypto-shaped hole needs some reshaping. I kinda handwaved passed the importKey step when implementing it. For the moment I've moved the old polyfill stuff to textsecure.subtle but we should port those calls over to crypto.subtle asap.

Group messages work ok for groups of size 2 (including the sender) but passing in multiple numbers to textsecure.messaging.createGroup causes an infinite loop (try adding a console.log at sendmessage.js:175).

I am not familar with Chrome Extension development so i can just give this short bug report. If SELinux is enabled the plugin crashes with:
ipc_channel_posix.cc(871)] Message needs unreceived descriptors channel:0x7fe3a0eb9000 message-type:4294967280 header()->num_fds:1
When SELinux is deactivated the plugin loads. Might be related to this old problem
http://code.google.com/p/chromium/issues/detail?id=81413

Since this extension is written in Javascript, it should be possible to reuse the vast majority of the code for different targets: for example, you could build a Chrome extension, a Firefox add-on, and a Firefox OS app all from the same code base, with only minor modifications for each target. The modifications you would need to make would be to support variation in the UX and variation in available crypto implementations.

I recommend that we define a uniform crypto interface (js/crypto.js) that is agnostic wrt the underlying implementation.

At the moment, it appears that you are using pure-JS impls. of all your crypto functions except for Curve25519, which is running in Native Client. It would be easy to support a cross-platform, pure-JS version of Curve25519 by running an Emscripten-compiled version of curve25519 in a Worker.

Additionally, from a quick scan of the protocol design doc, it appears the following primitives are used:

1. Curve25519
2. HMAC-SHA256
3. HMAC-SHA1
4. AES-CBC
5. AES-CTR
6. PBKDF2
7. HKDF

With the exception of Curve25519, all of these primitives are part of the current Web Crypto spec. If we define a clean, implementation-agnostic crypto module from the beginning, then it would be trivial to take advantage of Web Crypto when it becomes available. Given the current state of efforts for Web Crypto, it seems reasonable to expect it to be available by the end of the year.

As you mention in the README, "I'd be glad to accept a pull that abstracts out the NaCL-specific stuff to optionally use a JS implementation for FF". I'm suggesting we go even slightly more abstract in this issue, to allow a mix-and-match of pure JS, Native Client, Emscripten, and eventually Web Crypto.

Hi,

I have tried to use the test.js to see if textsecure-chrome can successfully decrypt incoming messages.

Specifically I have taken a request from an android textsecure device, and added the bob keys that it was encrypted for.

It is able to decode the messages (successfully reading the embedded preKeyId etc) however the verifyMACWithVersionByte when called in decryptWhisperMessage raises "Bad MAC"

I'm just wondering if you can verify that textsecure-chrome should be able to decrypt messages from the official android client? Or if there is something messed up with the bob keys I have set.

Currently we dont even show (or even store) outgoing messages, also, we should change UI to show conversations, not individual messages.

If you don't receive a message for a minute, the websocket dies and the background page must be refreshed to fetch new messages.

...we dont have it

I just wanted to hang a link to these ASM.js benchmarks of the NaCL crypto library for anyone interested in porting this to Firefox/Firefox OS.

Attachment ids returned from the server are parsed and handled as numbers, resulting in a loss of preicision for very large attachment ids. e.g.: this JSON blob

{"id":8697384559160012696,"location":"https://whispersystems-textsecure-attachments-staging.s3.amazonaws.com/8697384559160012696?..."}

becomes this JS object

{ id: 8697384559160013000,
  location: "https://whispersystems-textsecure-attachments-staging.s3.amazonaws.com/8697384559160012696?..."}

It would be nice if the server could wrap the id in quotes (as specifed by the API docs). Else we'll have to parse it out of the raw response or out of the location url.

It'd be even nicer if we could handle attachment ids as strings end to end, but the protocol layer encodes them as fixed64.

Outgoing messages have integer timestamps returned by new Date().getTime(), while incoming messages have timestamp objects produced by decoding the uint64 protobuf field type. These objects are of the form {high: ..., low: ..., unsigned: true}, the representation of a Protobuf.Long. This leads to message mis-ordering when we try to sort by timestamp.

...we dont have it

with mocha-phantomjs, we get failures when trying to use some modern (though not-yet official/standard) browser features, e.g.:

ReferenceError: Can't find variable: Promise

and

TypeError: '[object Uint8Array]' is not a valid argument for 'Function.prototype.apply'

I've been looking at JS app frameworks and I feel that we should pick one, or at least commit to some patterns and strategies therein, to help structure and organize our code. This will add some overhead to our lives in the short term but will help us create a cleaner and more maintainable code base in the long term, improving the lives of our future selves and contributors.

Some general goals here:

• code structure / organization
• modularity
• testability
• security
• cross-browser compatibility
  • someday, Firefox.
• developer friendliness
  • low overhead to learn and apply
  • makes our code more understandable, not less

Options:

• Backbone.js offers extendable Models and Collections with built in inheritance, and allows for integration with your choice of templating system and data storage layer.
• Ember.js has a similar set of base features to Backbone but is more UI-component focused. It is fully integrated with Handlebars templates and agnostic to data storage layer.
• Angular.js allows creation of custom html tags and properties, but probably has the steepest learning curve of the bunch.

We could also consider some lighter-weight alternatives that simply help us modularize without introducing any fancy data structures or other mvc features:

• Browserify lets you create nodejs-style module files and compiles a single resultant js file for inclusion in a webpage.
• RequireJS is another module loader but can load modules dynamically at runtime.

So far I'm leaning towards Backbone, as it seems the least opinionated of the full MVCs and doesn't tie us to a particular templating system. It focuses on making things easier in JS land, and feels more like a helpful library than an authoritative framework. It also parallels a lot of Ruby on Rails conventions, which appeals to me personally as a Rails veteran. It could be combined with browserify or requirejs for module loading. See also: http://backbonejs.org/#FAQ-why-backbone

Ember is a strong contender but seems more specifically adapted to frontend-UI-heavy and server-backed apps where models and views are tightly coupled to server-side routes. Our app is definitely more local-backend-js-heavy and should have a characteristically clean, simple UI. Plus I'm not really sold on Handlebars.

Angular I tend to rule out simply due to its relative opaqueness to newcomers.

The disclaimer here is that I've not actually used any of these frameworks before. Discussion and arguments for/against these and other options is hereby requested.

I think build instructions would be very helpful in getting more developer help, I'd be interested but have no idea where to start!

currently it's the opposite.

https://github.com/TheBlueMatt/textsecure-chrome/blob/master/TODO.txt

A wild scrollbar appears around <= 500px tall and >= 500px wide (ie wide enough to have the gutter expanded).

especially in crypto code, generally use array buffers everywhere and just convert into them on the edges (ie from localStorage/protobufs/etc)

...to test the (unpushed) code which handles this.

Got the repo clone and have the extension running.

The Send single-client code button is firing off two requests to bluematt's service but I don't get any text message code nor do I get anything if I check the response on the request. Chrome says "This request has no response data available."

Is there something with the http://sushiforeveryone.bluematt.me/v1/accounts/sms/code server?

A list of what is currently working would be appreciated so I know what's working as expected and what needs fixing/working on :)

Thanks!

P.S.

Currently testing on "Google Chrome Version 35.0.1916.114 m" on Windows 7 if that matters.

When a conversation is opened or a new message arrives, we need to scroll to the bottom (most recent) of the message list.

I'm trying to get a functioning development install so that I can try to help out with bugs, but I'm encountering problems.

I've got the extension installed correctly, but whatever I do with the options page, the "Send SMS" button greys itself out, and I'm actually unclear how I'd get a functioning account configured for development purposes.

Could someone describe those steps for me? I can PR README changes or something once I know them.

Current master isnt showing received messages even though they appear to make it in via background. Probably changed the API and @liliakai hasnt had a chance to fix the backbone views yet?

The code is missing a license.

Hey,
I installed the add-on chromium today, but wasn't able to register (I got an HTTP error : -1), and using the multi device feature isn't clear. When scanning the qrcode with barcode scanner on my phone, the URL given isn't recognized although I have TextSecure installed (from PlayStore).

So can we send messages with this add-on at the moment ? If yes which version of TextSecure is needed, and how to register multi devices ?

I think these informations could be added into the readme

Hi, I am testing this plugin just out of mere curiosity. The problem is that whatever phone number I try to send a message to, it says it's invalid. Is this the expected behaviour at this point in the development, or is something else wrong?

We have like...two, and it needs to be clearly cut and defined, with nice API lines between

Currently the test page clobbers localStorage. This is less than ideal, particularly as the project matures. Most of our code should be testable without actually touching local storage.

As moxie suggested in pull #77 we should probably use some sort of dependency manager like bower or require.

Thoughts?

EDIT: After looking at bower I think we'll still need something like Grunt to add the appropriate <script> tags to background.html and index.html if we go this route.

Improve formatTimestamp() in js/views/message.js

• Display HH:MM for messages sent within the past day or so
• il8n

The new-message form is functional but ugly and needs an improved phonenumber validation UX.

This needs to be formalized, proposed+implemented in the android (and iOS, eventually) side, and then implemented here.

Hello,

I was curious about the extension and wanted to test it but i couldn't pass the 1st screen i don't receive the number with a genuine number or "fake" one such as : http://sms-verification.com

but maybe the verifiction server is down today :)

Hi, I don't seem to be able to use (actually, try) this plugin when using Chromium on Ubuntu.
When I load the extension with Chrome on Windows a page immediately opens asking me to register. On Ubuntu, this doesn't happen (not sure why). I've tried to look for the page that should do this but I couldn't find it. When I try to open "options.html" all I get is a blank page.
What am I doing wrong?

Hey,

I decided I'd try and get something done on this since I have a bit more web dev experience now.

I used Google Voice to register (which went fine) and if I try to send a message to myself I only get the outgoing, not the incoming. Here's the console output

Connected to server! api.js:344
Successfully decoded message with id: 0 helpers.js:574
Error handling incoming message:  helpers.js:667
TypeError: Failed to execute 'sign' on 'SubtleCrypto': No function was found that matched the signature provided. {stack: (...), message: "Failed to execute 'sign' on 'SubtleCrypto': No fun…on was found that matched the signature provided."}message: "Failed to execute 'sign' on 'SubtleCrypto': No function was found that matched the signature provided."stack: (...)get stack: function () { [native code] }set stack: function () { [native code] }__proto__: Error helpers.js:668
Successfully decoded message with id: 1 helpers.js:574

When I try and send a message to my actual phone (Android running latest TextSecure) I don't receive anything and nothing prints out in the dev console.

When I click out of the TextSecure window I'll get a message such as 0x163AA665 is not a valid instance ID. background.html:1 (not sure if that's intended or not)

I'm using Google Chrome Version 38.0.2125.104 (64-bit) on Linux Mint at the moment. All the tests are passing.

Any ideas what I'm doing wrong? Just need some help over the initial bump so I can try and contribute.

These should be rejected and treated as if an attacker stole old message keys and created new messages after the ratchet's proper owner had moved on.

When trying to load the options page after a localStorage.clear() on latest master.

Not sure that we want to do anything for this aside from switching deps from the minimized form most of them are currently in and check for any semi-obvious nastyness in them, but we should do that.

When requesting prekeys for recipient from the server, the response comes back successful, but saveDeviceObject throws "unsure of how to jsonify object of type undefined", which is caught and converted into "Failed to retreive new device keys for number".

I think the undefined is coming from response[i].registrationId on L486 of helpers.js.

Hello,
I am trying out this TS plugin for fun. As I launch the extension in Chrome I am prompted to scan a QR code but when I do, instead of a link I am given a string (some "gibberish"). Is that the expected behaviour? Will it have to be scanned with the mobile TS app? Or should I do something else? How can I try it?
Thanks.

Please add license to files which are missing license, checking git log of each file to ensure that everyone who has contributed significantly signs off...

Registration is getting stuck on the key generation step.

This may be because the keyIds are not being generated correctly. All 100 keys are getting the same keyId. The first run, it is keyId 100, the second run is keyId 200, and so on. This is happening because keyId is set to i which is a reference to the loop iteration variable, rather than a copy of it.

XMLHttpRequest cannot load https://whispersystems-textsecure-attachments-staging.s3.amazonaws.com/...
No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'chrome-extension://...' is therefore not allowed access. The response had HTTP status code 403.