argonne-national-laboratory / megandroid Goto Github PK

A switch is needed for "Out of band". This should default to"on".

Some kind of feedback for the user is needed here. There's no way for the user to tell that a revoke process has been initiated.

The uppermost bar, where phone information is shown, is black. It should match the comps.

During registration, if you click on the "Advanced" button and return to the registration screen, you will lose the fields you've filled out. The registration screen should be sticky. This will be improved by the implementation of #2

The header area should match the green in the comp. Selected field underlines should be the same color (they are currently the color of the icons). Note #3 icons are also problematic.

This icon should appear next to the password field. When clicked the icon should provide help text regarding the password and its use. The current draft of text is the following:

This will be your private key password. Do not share this with anyone.

I think we might want to alter this slightly. We should probably add something about losing the password will make messages unrecoverable.

In the advanced options screen, users should have the ability to enter their own preexisting PGP private key. This should be achieved with a file selection dialog where the user can upload his or her .asc.

A screen is needed that will list the user's contacts. It would be nice if this could be setup in a way similar to WhatsApp and Signal, where the contacts are displayed from the normal Android address book. It would be a nice if the user could choose whether or not to allow access to the Android address book or keep contacts separate. Me might need to discuss this point.

The most important function of the contact list would be to facilitate the verification and signing of keys for web of trust. It should be possible to verify a contact's identity using NFC, SMS, or Facebook.

Should have a switch for toggling, "Update only on Wi-Fi". This should default to "on".

Hard coded strings should @string resource. I believe these just need to be moved into strings.xml and called appropriately.

The spacing between the buttons and the "logo area" is incorrect. It would be preferable to center the buttons vertically in the whitespace.

Users should have the option to show/hide the password they're choosing as they type it for the first time. Refer to the design comps for more information.

The user should have the ability to select a MEG server. In the specs we have this listed as a text field that defaults to meg.risc.anl.gov, however, I believe it should be mobileencryptiongateway.org.

From the work plan document:

• You're installed Page (same as "home" when you open app)
  --- Description of how to use the app

None of this is represented in the design comp. We need to further spec this out. How long is the description? Is it gone when the user revisits the home page? At one point we had talked about a video here.

What is the home page in this context? Is it the screen you see when the app is launched and you still need to sign in or is it the screen you see when you're logged in?

We need to pre-populate as much of the data as possible on the login screen. If fields can't be populated they should be left blank.

It's been noted that we need to support importing of PGP keys to the app. The safest way to transfer the key would be some type of physical means i.e. QR codes like we've done before. Should we create an option in the email client add on to display a private key as QR code so that it can be scanned in to the phone?

Do y'all have any other ideas?

The user should be able to select the keyring update interval from a select box. This should default to 10 minutes.

ScanQRActivity.java needs to be rewritten using Camera2 or another library in order to get rid of the deprecation warnings.

It looks like my fix for #5 destabilized the qrcode scanner. This is probably due to a dependency upgrade.

Symptoms:

1. Completely uninstall and reinstall the app. The app should launch and function properly.
2. Complete the installation screen.
3. When the barcode scanner comes up, after installation, the app will crash.
4. After the first crash, the app will continue to crash forever, every time it is launched. A complete uninstall is necessary.

There should be a screen for blessed clients. Each client should have a dropdown menu next to it. This should default to "Forever" but can be changed to a different interval.

This should be a switch that defaults to true. In other words it should be toggled on by default. See the switch under Android controls here: https://material.google.com/components/lists-controls.html#lists-controls-types-of-list-controls.

The main screen that appears when a user is connected and logged into MEG needs work. The icon, colors, and information displayed are all in need of attention.

KeyGenerationLogic.java uses the SecureRandom library. Supposedly there's a security vulnerability here. Additional analysis should be done to determine if this is still the case. If it is, this vulnerability should be eliminated.

Currently there's not a good way to manage multiple clients. This could be achieved by adding a client or transaction ID.

The logo text that says, "MEG Mobile Encryption Gateway" is poor quality. It would be best if this could be setup as an .svg.

Do these need to be images? Perhaps these can be implemented as SVGs. In any case the background should be transparent on icons.

This is slightly separate from the related issue on MEG Server. On key revocation, MEG Android continues to try to use the old key.

Instead of launching the QR code scanner upon signing up, the user should be taken to an interstitial screen. This is referred to as a "jump screen" in the work plan. This screen should have a description of the QR code and what it is supposed to do, etc. It should also have a button that would allow the user to launch the QR code scanner.

Specs forthcoming. See #15