agl/pond — pull request #144 by burdges (2014-11-27 20:12:39+00:00)
Title: Send messages to multiple recipients, optionally introducing some of them to all the others

This is a preliminary pull request. I'm happy to implement any suggestions.

Ram, Alan, and I originally added the ability for contacts to introduce their contacts to one another by sending each a message containing the other's name and public identity, and proposed PANDA scared secret. This basic functionality is visible in https://github.com/burdges/pond/tree/9d341e1f3def9a5712aea3da50677322abeab7ab and avoids modifying any .proto files.

There is a risk that someone could exploit this introduce function to MITM two users whom they introduce to one another simply by giving them different shared secrets. I therefore added three new records introducedBy, verifiedBy, and introducedTo that record your local social graph as visible from messages containing introductions, which should aid users in exposing any MITM attacks. These tools are functioning by https://github.com/burdges/pond/tree/e7d77e528333c7303a43d487026cad8965406920 but note they require changing client.proto in 1c64ebbb and rebuilding client.pb.go in a4e91a07.

There were several rounds of attempts at a GUI rebased into 9d341e1f, some of which are visible in https://github.com/burdges/pond/commits/sendmany I ultimately decided the best approach to introductions was to just do multiple recipient messages, so now https://github.com/burdges/pond/commit/a682b071812a86681b3b77caf8bb0ca3f3f9535b mostly blows away our earlier work in 9d341e1f.

Sending messages to multiple recipients required adding multiple recipients to the Draft struct, so the to uint64 has been replaced by toNormal, toIntroduce []uint64, which also required adding them to client.proto in b3771354 and rebuilding it in 5016a0a7.

All commits should build and run without crashes except for 1c64ebbb and b3771354 which require their subsequent commits that rebuild client.pb.go.

Our TODO list :
- Add a checkbox to disable keeping the social graph information for users who do not want it.
- Fix usageString() so that it displays a more correct size over estimation.
- Repair any tests I broke with my GUI changes in composeUI, none obvious so far.
- Write our own tests for the multiple recipient functionality and introductions.
- Expose GTK's information dialog boxes in client/gtk.go
- Make dialog boxes that explain anything that needs explaining, like the risks of keeping the social graph data, what to do if an introduction creates a second contact with a similar name, etc.

We'd appreciate feedback on these questions :
- How should introduction messages be encoded? I'm overly fond of our current format, which is a URI of the form pond-introduce-panda://NAME/SECRET/IDENTITY/ Instead, we could either build introduction messages into the pond.Message proto format, or else choose a more informative URI, like maybe pond-introduce:NAME?pandaSecret=SECRET?identity=IDENTITY
- I've had a request to allow renaming contacts when doing introductions so that someone can be introduced using a different name than the one used locally.