NationStates++ | Extension for NationStates

[Singpu]

What about using OpenID to verify? That's the very purpose of OpenID, after all.

[Afforess]

What about using OpenID to verify? That's the very purpose of OpenID, after all.

Users still have to create a separate OpenID account and link it with their nationstates. Maybe if NationStates accounts were an account provider, and all users automatically had an account, I could use it.

Edit: I don't really need a massively over-engineered solution either. Just way to verify that if someone tries to retrieve or set data based on a nation name, that I can verify that they are who they say they are. The simplest idea I have is something like the existing chk value, except public. A user's 'id value' is on a hidden field in every page. When they send a request to me to modify data, my server calls nationstates.net/nation=testlandia/idvalue and that page has the SHA256 HASH of the current user id value. if the SHA256(user id value) sent to my server == nationstates.net public hash, I can verify the nation.

Heck, you can probably use the existing chk values. Just make a public facing url for the SHA256 or some similar one-way checksum of a nation, and I can verify the user chk == public hash.

[[violet]]

Edit: I don't really need a massively over-engineered solution either. Just way to verify that if someone tries to retrieve or set data based on a nation name, that I can verify that they are who they say they are.

How about I create a page that displays a checksum when visited by a logged-in nation, and an API call that lets anyone supply a nation name + checksum and be told whether that's a valid combination for a logged-in nation. The checksum would cease to be valid once the nation logged out.

It would be like chk but of no use for XSS attacks. Other 3rd-party sites could use it too.

[Afforess]

Edit: I don't really need a massively over-engineered solution either. Just way to verify that if someone tries to retrieve or set data based on a nation name, that I can verify that they are who they say they are.

How about I create a page that displays a checksum when visited by a logged-in nation, and an API call that lets anyone supply a nation name + checksum and be told whether that's a valid combination for a logged-in nation. The checksum would cease to be valid once the nation logged out.

It would be like chk but of no use for XSS attacks. Other 3rd-party sites could use it too.

Sounds good. Let me know when/if you get this up and I'll switchover ASAP.

[Planeia]

It doesn't seem to updating my telegrams, I still have to refresh or go to a different page.

[Afforess]

It doesn't seem to updating my telegrams, I still have to refresh or go to a different page.

Easy way to show it works:

Open your nation in 1 tab. Open your telegrams page in another tab. In your telegrams tab, compose a new telegram to yourself. Send it, and then close the telegram tab without reading the new telegram. If you wait a few seconds, your nation tab will show you have 1 telegram.

I just tested it. It works.

[[violet]]

How about I create a page that displays a checksum when visited by a logged-in nation, and an API call that lets anyone supply a nation name + checksum and be told whether that's a valid combination for a logged-in nation. The checksum would cease to be valid once the nation logged out.

It would be like chk but of no use for XSS attacks. Other 3rd-party sites could use it too.

Sounds good. Let me know when/if you get this up and I'll switchover ASAP.

I've added this: details in the API documentation (may need an F5 to refresh).

So nations can generate authentication codes via this page and 3rd-party sites can verify them via the API.

In this particular case, your extension could grab the authentication code itself (perhaps using the lightweight version of the page) without requiring the user to do anything.

[Afforess]

Awesome! Digging into it now.

[Afforess]

Sounds good. Let me know when/if you get this up and I'll switchover ASAP.

I've added this: details in the API documentation (may need an F5 to refresh).

So nations can generate authentication codes via this page and 3rd-party sites can verify them via the API.

In this particular case, your extension could grab the authentication code itself (perhaps using the lightweight version of the page) without requiring the user to do anything.

Everything looks good. I have updated my server and disabled the authentication bot. Now nations make a post request to www.capitalistparadise.com/api/firebase/ with their nation name and authcode. I check the authcode, and then generate a firebase token to reply with. The extension has also been updated to use this new system, it's much faster now.

[Thori]

I'm on Google Chrome 18.0.1025.142 m on a PC with Windows 8 right now. I can't install the extension.

[Afforess]

I'm on Google Chrome 18.0.1025.142 m on a PC with Windows 8 right now. I can't install the extension.

Google Chrome 22 is the minimum supported version. Google chrome is at version 28.

[Radiatia]

I've noticed the Firefox version seems to have suddenly stopped working for no apparent reason. Everything was awesome and then suddenly, nothing.

EDIT: Never mind, I just re-downloaded it and now it's better than ever!

[Shantak-kun]

When can we expect a safari add-on?

[Frisbeeteria]

When can we expect a safari add-on?

You should at least glance at the thread before repeating questions that have been asked before.

When can we expect a Safari version?

After it happens. I don't give ETA's because I never can predict.

[Afforess]

When can we expect a safari add-on?

I am blocked from working on it. The Apple Developer center was hacked a week ago and has been taken down. I can not set up a Safari extension until it is back up: https://developer.apple.com/support/system-status/

[Economa Incorporated]

Bookmarked this a bit back, and just installed it after some people I know were complaining about copy-pasting RMB links, so I could try and then recommend it. Love it! Thanks for making my life easier. Probably my favorite feature is the puppet switcher, as it simplifies it to a one-click deal.

Thanks again from a satisfied customer!

I will recommend to my friends.

[The Republic of Lanos]

Happy to say that my "add-ons not starting up when starting Firefox" issue was resolved by a full system factory restore. >_> Aside from saving all my data, Firefox works perfectly.

[Leutria]

Could it be made so you still have the message box after leaving a message on the RMB? Or at least have something to click to open it again?

[The United Soviet Socialist Republic]

I would love this....If I used Chrome or FireFox. I use Opera.

[Leutria]

You could go to this page and add the idea of Opera support. I bet if a lot of people vote for it Afforess would look into it.

[The United Soviet Socialist Republic]

You could go to this page and add the idea of Opera support. I bet if a lot of people vote for it Afforess would look into it.

Only around 1% of Internet users use Opera, I doubt many people would vote for the idea.

[Leutria]

5.45% of Wikimedia visitors as of June 2013, not much, but still something. I use Firefox, so I am indifferent

[Verbluffen III]

Could this possibly work for IOS?

[TaQud]

Could this possibly work for IOS?

again,

When can we expect a safari add-on?

I am blocked from working on it. The Apple Developer center was hacked a week ago and has been taken down. I can not set up a Safari extension until it is back up: https://developer.apple.com/support/system-status/

[Verbluffen III]

Could this possibly work for IOS?

again,

I am blocked from working on it. The Apple Developer center was hacked a week ago and has been taken down. I can not set up a Safari extension until it is back up: https://developer.apple.com/support/system-status/

DARNIT.