Don't use letters in me2mom access code.

Don't use letters in me2mom access code.

BUG=None
TEST=None


Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=86187

[Jamie, 2011-05-20 01:28:21]

http://codereview.chromium.org/7048020/diff/1/remoting/webapp/me2mom/remoting.js
File remoting/webapp/me2mom/remoting.js (right):

http://codereview.chromium.org/7048020/diff/1/remoting/webapp/me2mom/remoting...
remoting/webapp/me2mom/remoting.js:258: function
normalizeAccessToken(accessCode) {
Do we need to do this at the client? Since we do it at the host, it seems
redundant and means that we have two pieces of code to keep in sync if we ever
decide to change the alphabet.

[Jamie, 2011-05-20 01:32:49]

http://codereview.chromium.org/7048020/diff/1/remoting/webapp/me2mom/remoting.js
File remoting/webapp/me2mom/remoting.js (right):

http://codereview.chromium.org/7048020/diff/1/remoting/webapp/me2mom/remoting...
remoting/webapp/me2mom/remoting.js:258: function
normalizeAccessToken(accessCode) {
On 2011/05/20 01:28:21, Jamie wrote:
> Do we need to do this at the client? Since we do it at the host, it seems
> redundant and means that we have two pieces of code to keep in sync if we ever
> decide to change the alphabet.

Actually, I retract that. We should only be doing it in one place, but the
client is the correct place to ensure that the correct code is used when talking
to the cloud. Can you remove the conversion in the host?

[Jamie, 2011-05-20 07:46:20]

http://codereview.chromium.org/7048020/diff/1/remoting/webapp/me2mom/remoting.js
File remoting/webapp/me2mom/remoting.js (right):

http://codereview.chromium.org/7048020/diff/1/remoting/webapp/me2mom/remoting...
remoting/webapp/me2mom/remoting.js:258: function
normalizeAccessToken(accessCode) {
On 2011/05/20 01:32:50, Jamie wrote:
> On 2011/05/20 01:28:21, Jamie wrote:
> > Do we need to do this at the client? Since we do it at the host, it seems
> > redundant and means that we have two pieces of code to keep in sync if we
ever
> > decide to change the alphabet.
> 
> Actually, I retract that. We should only be doing it in one place, but the
> client is the correct place to ensure that the correct code is used when
talking
> to the cloud. Can you remove the conversion in the host?

And while we're at it, can we remove one of 5 and S? While testing out some of
this stuff, I've noticed that they look really similar, at least in my
handwriting (and I bet people will end up writing down these codes if the
computer isn't next to the phone for example).

[Sergey Ulanov, 2011-05-20 16:53:23]

Yeah, we need to normalize the code before we generate auth token, otherwise
there is no way to validate it on the host. I've removed code than normalizes
the access code when verifying access token. 
Also added S/5 exception - this needs to be fixes in the support_id generation
code in the directory firts.

On 2011/05/20 07:46:20, Jamie wrote:
>
http://codereview.chromium.org/7048020/diff/1/remoting/webapp/me2mom/remoting.js
> File remoting/webapp/me2mom/remoting.js (right):
> 
>
http://codereview.chromium.org/7048020/diff/1/remoting/webapp/me2mom/remoting...
> remoting/webapp/me2mom/remoting.js:258: function
> normalizeAccessToken(accessCode) {
> On 2011/05/20 01:32:50, Jamie wrote:
> > On 2011/05/20 01:28:21, Jamie wrote:
> > > Do we need to do this at the client? Since we do it at the host, it seems
> > > redundant and means that we have two pieces of code to keep in sync if we
> ever
> > > decide to change the alphabet.
> > 
> > Actually, I retract that. We should only be doing it in one place, but the
> > client is the correct place to ensure that the correct code is used when
> talking
> > to the cloud. Can you remove the conversion in the host?
> 
> And while we're at it, can we remove one of 5 and S? While testing out some of
> this stuff, I've noticed that they look really similar, at least in my
> handwriting (and I bet people will end up writing down these codes if the
> computer isn't next to the phone for example).

[Sergey Ulanov, 2011-05-20 19:38:11]

I've changed host code to use digits only for the host secret.

[Sergey Ulanov, 2011-05-20 22:34:04]

ping ping

[Jamie, 2011-05-20 22:37:55]

http://codereview.chromium.org/7048020/diff/11002/remoting/host/support_acces...
File remoting/host/support_access_verifier.cc (right):

http://codereview.chromium.org/7048020/diff/11002/remoting/host/support_acces...
remoting/host/support_access_verifier.cc:23: const char kHostSecretAlphabet[] =
"0123456789";
I think this wants to be 7, since the support id is 9 digits and we want 16
overall.

[Wez, 2011-05-20 22:41:26]

On 2011/05/20 22:37:55, Jamie wrote:
>
http://codereview.chromium.org/7048020/diff/11002/remoting/host/support_acces...
> File remoting/host/support_access_verifier.cc (right):
> 
>
http://codereview.chromium.org/7048020/diff/11002/remoting/host/support_acces...
> remoting/host/support_access_verifier.cc:23: const char kHostSecretAlphabet[]
=
> "0123456789";
> I think this wants to be 7, since the support id is 9 digits and we want 16
> overall.

LGTM with Jamie's suggested change in place.

[Sergey Ulanov, 2011-05-20 22:42:41]

http://codereview.chromium.org/7048020/diff/11002/remoting/host/support_acces...
File remoting/host/support_access_verifier.cc (right):

http://codereview.chromium.org/7048020/diff/11002/remoting/host/support_acces...
remoting/host/support_access_verifier.cc:23: const char kHostSecretAlphabet[] =
"0123456789";
On 2011/05/20 22:37:55, Jamie wrote:
> I think this wants to be 7, since the support id is 9 digits and we want 16
> overall.
Length of support ids generated by directory is not fixed: it may be 9 or longer
(though in most cases it will be 9). I would prefer changing length of support
id to 8 - it would still provide enough entropy (100M possible values).

[Jamie, 2011-05-20 22:53:17]

On 2011/05/20 22:42:41, sergeyu wrote:
>
http://codereview.chromium.org/7048020/diff/11002/remoting/host/support_acces...
> File remoting/host/support_access_verifier.cc (right):
> 
>
http://codereview.chromium.org/7048020/diff/11002/remoting/host/support_acces...
> remoting/host/support_access_verifier.cc:23: const char kHostSecretAlphabet[]
=
> "0123456789";
> On 2011/05/20 22:37:55, Jamie wrote:
> > I think this wants to be 7, since the support id is 9 digits and we want 16
> > overall.
> Length of support ids generated by directory is not fixed: it may be 9 or
longer
> (though in most cases it will be 9). I would prefer changing length of support
> id to 8 - it would still provide enough entropy (100M possible values).

Okay, since we have yet to write the pretty-printing code, LGTM for now, but I'd
like to have a broader discussion of this at some point so that we can assess
the security/usability trade-offs we're making.

[commit-bot: I haz the power, 2011-05-21 00:46:21]

Change committed as 86187