dimensiondev / maskbook

The portal to the new, open Internet. ([I:b])

Mask Network

Mask Network is a portal to the new, open internet, that bridge from Web2.0 to Web3.0 . With Mask Network, you can send encrypted posts to your friends, trade your best token on Twitter, enjoy NFT pfps, participate in crypto lucky-draws, and share encrypted files on the platforms you are already using.

For general introductions, see Mask.io.

Downloads

• Mask Network on Chrome Web Store
• Mask Network on Firefox Addon Store

Useful Links

• User Forum
• Report Bug
• Twitter
• Facebook
• Telegram
• Discord

Developer documentation

Please check out docs

Reporting a Vulnerability

Contact: security (at) mask.io

see SECURITY.md

Work for Mask Network

Please submit your resume to jobs (at) mask.io

maskbook's Issues

[Bug] Decryption is displayed multiple times

Switch to WebExtension API

See: https://github.com/mozilla/webextension-polyfill

Regarding the key retrieval foreground process

Can we create a headless driver inside the current tab making the queries?

Payload format

Let there be a space character between with Maskbook.io: and 🎼.

[Feasibility Check] Cooperative friendship discovery mechanism

I wish that we can have un thorough and in-depth review on the proposed cooperative friendship discovery mechanism before @Jack-Works coding it into reality. Commentaries from @yisiliu and @mindey are especially expected.

Thanks all.

Use https://www.npmjs.com/package/construct-style-sheets-polyfill

gungame.herokuapp.com deleted, remove from code, throwing errors

Hey sorry, gungame.herokuapp.com got deleted (heroku complaining I'm using too many hours) and I need the hours for my scaling tests (please don't use the testing peer).

I should have checked first before deleting it, cause I see it now in your code.

The problem is now that I've deleted it, any peer connected to it will start throwing errors constantl, as it'll try reconnecting every 2 seconds and fail.

So sorry about this! None of those peers were intended for production use.

The good news is the scaling tests are going super well, so expect a bunch of new peers with AXE that will auto DHT peer discovery and stuff! Hopefully next several months it'll be out!

This issue is a heads up warning about the deleted peer and the resulting errors throwing.

[UX] Account ownership verification process consolidation [draft]

Background

It can be hard to ensure that the automatic verification posting mechanism can work, so we need some saturation measures to ensure that the public key is posted, in bio or in post.

Some basic change on setup

Measure 1: Just-in-time Self-checking

As soon as the setup is completed (proof(s) automatically added), the extension shall immediately check if the proof is really added to bio and really posted on timeline. If no proof is online, the user will receive alert message like "automatic proof failed, please add manually", and will be guided to post the public key.

Error handling: User bio may have no enough space for the public key. This will lead to failure of bio update and the other method of proof is the only possible way. In the best case, we can detect the available space in user bio so we can ban the option when it is not possible.

Measure 2: Continued Self-checking

The extension shall periodically check the proofs of claimed accounts of the user to see if they are validly connected.

If the proof is no longer available, the user will receive alert message like "proof broken, please re-add". This alert should appear only when the user is logged in as the Facebook account.

[Discussion] What are good ways to encrypt comments?

• Use the same AES key for the post.
• Use the SHA512 of the whole post as the AES key.

Are there other options that we may consider?

[Bug] 'Add Recipient' Button display bug

Not reproduced by my side yet. Maybe caused by racing

[Bug] Fail to decrypt Shared/Folded post

Suspect since the payload msg is too long and folded, maskbook fail to detect

Feature: Backup alert

Such a backup alert shall appear if:

• Last saved backup was 168 hours ago; or
• No backup saved ever

... and:

• The last time the user manually clicked "close" was within the last 168 hours.

The alert text shall differ according to the case.

• Last backup was 7 days ago.
• Create your first backup!

Notice:

• There can be saved backup (saved) and unsaved backup (user clicked "cancel").
• Regardless of manual closings, the time span for "X days" always starts from last saved backup.

Banner for users without actively connected Facebook account

Click to jump to dashboard, which should now show two options — new user or returning user.

If the user clicks "close", the "link" at the bottom of left panel will appear.

[UX] Error handling: What if the user tries composing with Maskbook while there is no active account-keypair combination in the local database

Let nous think.

Add a Readme

CSS Height bug

Close all pinned tabs if Maskbook background script refreshed

Fix Storybook

Ship a compressed build to optimize size and speed

Add and Improve Tutorials

Will add feedbacks from users here:

• Change the account ownership proof procedure more intuitive by switching to the double column frame. Reference: #23

Provide a stable extension id for users that install from source and for development

AES-CBC compatibility

First off, incredible work!

Second off, don't let anything I'm saying delay launch, timing is way more important.

Third, AES-GCM is more secure than AES-CBC (tho obviously, there infinitely forever will be "X is better than Y" problems, so I'm not going to be naive that CBC has a tradeoff perhaps you intended?).

Fourth, I forget exactly what it was, but I think I found compatibility issues between NodeJS WebCrypto implementations and browser. Altho this may be because at the time I wasn't fully using node-webcrypto-ossl (the other projects failed to be fully implemented enough, or had tiny padding problems). I think it was that CBC with the other libraries (not OSSL) were what caused the compatibility issues. So just keep this in mind, GCM wound up being easier to find cross-environment working solution.

(and, well, we use GCM, so that is a selfish reason GCM could help. Please be honest, was there issues with SEA wrapper?)

Problem with add Decrypter - unintended Decrypter in the List

Not yet reproduced by my side.

Unify width of panels in welcome guide

According to the Sketch prototype, it should be 600px.

Support Mnemonic Code for easy key restoration

We should also support Mnemonic Code for easy key restore, as is done in https://github.com/DimensionDev/PriceDoge/blob/master/extension/src/utils/keyStore.ts

Originally posted by @yisiliu in #11 (comment)

Memory on some service functions

decrypt from

[Bug] UI display error

Not reproduced on my side yet.

[Feature] Highlight URLs and make it clickable in decrypted texts

For example: when user post https://maskbook.com in the encrypted text, receiver should able to click the URLs directly.

Please follow fb default setting about open URLs in new tab or not.
點擊鏈接是否彈出新窗口請根據facebook默認行為。

Unintended $self in 'add Decrypter'

如果这个下个版本按照JN的设计会没有的话就不用管了。

DOM Inserts Break Isolated Worlds

This was a tricky thing I struggled with.

Chrome offers Isolated Worlds for extensions to manipulate DOM without host knowing.

However, any DOM inserts/etc. can be witnessed by host.

This lets hosts fingerprint users for what extensions they are using, and also identify extensions.

So it is better to avoid any DOM inserts until necessary (for instance, decrypting*, and in your case, showing encryptor UI).

https://github.com/project-maskbook/Maskbook/blob/16c31b803a578888a91f48477a7dbc57a382d371/src/extension/injected-script/index.ts#L7

*it is vital that decryption is not inline or else host can scrape decrypted text after the fact, that is why I use an iframe which prevents them from scraping decryption, tho it is much harder to get the render right. Ultimately, DOM insert is inevitably going to occur, so this issue is kinda FUD, but I'll be following up by looking (or could you link?) at how decrypt is handled, cause that is much more serious.

And again, just making notes now while I have some time, keep focused on launching with the epic timing of all this crazy stuff going down.

[Discussion] Is it possible that maskbook do not open a lot of tabs?

Users still will figure this easily and this is will definitely make user uncomfortable.

Wondering is there anyway that we achieve this wo opening new tabs?
Oh do you have to build our own browser sometime?

[Discussion] Feature -- Remove Decrypter

[Feature][UX] Remind user to post pub-key

Situation:

Alice installed Maskbook and posted the pub-key;
Bob installed Maskbook and added Alice's pub-key into cached. He post a encrypted post to Alice before post his pub-key in bio/post.

Currently Alice will see error message:

 's public key is not xxx ... 

We should change error message:

• let it make more sense
• let Alice remind Bob to post his pub-key in bio/post (maybe?)

Also we need a better entry point for 1st time user to post pub-key

Keystore export file name

Use YYYYMMDD instead.

Two more columns in project board?

E.g. https://github.com/DimensionDev/Tessercube-Meta/projects/1

After click 'Post it!', the compose window will disappear while the post is not posted yet

It will cause the user to confuse
Reproduce on Chrome store ver

[Feature] i18n / Localization support

Support of zh-hant before May24 due to Business cooperation

Avatar Display Bug

You can add me https://www.facebook.com/suji.yan.me to see if we can reproduce this bug

improve i18n zh-Hant

這裏的中文版，“來解密”變成payload最後了

Guide modal last step

Update according to this.

And I prefer to let the gray box behaving like https://encodeuri.com/ output box. Readonly; focus to select all.

Support Firefox

Current Status: Available

• ✔ Background Service
• ✔ Options Page
• ✔ Content Script
• ✔ Injected Script

Components:

• ✔ Encryption
• ✔ Decryption
• ✔ Welcome from the webpage
• ✔ Welcome from the options page
• ✔ Auto verify post
• ✔ Auto verify bio

---

• Web Extension #13
• Custom events registered many times
• Inject error Error: "document.documentElement is null"
• Error: conflictAction prompt not yet implemented in Backup
• Error: Permission denied to access property Symbol.iterator (addEventListener.ts:40)

---

• Publish on Firefox

[Proposal] UserGroup Abstraction Model

Purpose

Every group of users, virtual or real, static or dynamic, should be identifiable across every node of the network and every member of the group should be able to retrieve necessary keys to decrypt the contents which they legitimately qualify decrypting by providing certain proof of their membership of the group.

Design

Example

In the context of Facebook, specifically, there are several scenarios how people interact in timelines.

Type	Description	Group ID
Virtual Group	Friends of Alice	FB::{ fb_uid_Alice }>>>F0
Virtual Group	Friends of friends Alice	FB::{ fb_uid_Alice }>>>F1
Virtual Group	Certain selected friends of Alice	FB::{ fb_uid }>>>FS>>>{ SHA512({ fb_uid_Bob }+{ fb_uid_Siri }+...) }
Real Group	Closed Group	FB::{ fb_uid_Group }>>>G0

In order to make sure the Group ID being constructed can be universally unique in the cosmos of Maskbook, in respect to expectation on portability to other social networks, I suggest composing it in such un way.

Rules

Basic part:

• Social network identifier, [0-9A-Z\-]{2,128}
• 2 colons, ::
• Group primary identifier (publisher UID for virtual group, group UID for real group), base64 if necessary (supposedly never)

Optional part:

• 3 greater marks, >>>
• Group type code, [0-9A-Z]{2,8}
• 3 greater marks, >>>
• Group secondary identifier (defined in each scenario)

---

And, the default generation of group secondary identifier is:

• Make un ordered array of UIDs of participating members, sorted by Unicode dictionary order.
• Join the array by +++ to make un string.
• Calculate SHA512 of the string and the output encoding should be hex uppercase.

---

This proposal is at draft stage. Any idea is welcomed. This draft is expected to be finished on 2019 Apr 19.

Use Either type instead of Exception to reduce noise in console

[Placeholder][Draft] Extending Friendship Certificate Design

I have been thinking about a feasible implementation and extension of this mechanism. The following lied in my considerations:

• BitTorrent trackers or implementing a DHT (distributed hash table) for tracking requests
• "Buses" in CPU architecture, in which different types of data go through them with corresponding privileges. We can potentially build different "buses" based on GunDB with different functionalities and privileges. E.g., address bus for tracking, signal/control bus for transmitting operations and data bus for holding temporary friendship certificate issuing/renewing requests. This is an efficient design, and I would like to explore more on a distributed implementation of this.
• Using FB's graph API to get a user's friend list directly?
• Zero knowledge in certificates
• To be continued

Memo it

https://github.com/DimensionDev/Maskbook/blob/master/src/components/DataSource/PeopleRef.ts#L16

[Feature] Add entries for «Import Keystore» and «Publish Public Key» in decryption error messages

For example, for this situation:

We should remind the user that the private key is not imported or generated.

Event hijack has a race with native code

Nothing happens.
Hard to reproduce.

[Bug] Cannot recognize comment box

E.g.: https://www.facebook.com/sobsoldcom/
Maskbook cannot figure out the existence of the comment box

Failed to execute 'transaction' on 'IDBDatabase': One of the specified object stores was not found.

Hard to reproduce.
Suspect this bug is related to the outcome of some user changed their identifier.
Also, sometimes the contacts cached in the browser will lost.

Implement UserGroup Abstraction Model in group membership management

Documentation: https://github.com/DimensionDev/Maskbook/wiki/UserGroup-Abstraction-Model