"invalid twitter password" returned for seemingly valid password

[lucy]

Hi all,

I'm having some trouble using the TipJoy payment API; perfect time to
bounce what's happening off you all.

I'm sending an XmlHttpRequest in javascript. When I send the POST data
to my own server, extract the twitter_username and twitter_password
parameters, and make a call directly to twitter to update my status,
it works fine.

When I send the same POST to TipJoy, it returns a result failed
response, with the reason being "invalid twitter password".

Below is some information to help someone else reproduce or inspect
where things are going wrong:

Javascript:

I'm calling this from a firefox extension which reproduces much of
greasemonkey's functionality. I'm using the GM_xmlhttpRequest method
documented here
http://diveintogreasemonkey.org/api/gm_xmlhttprequest.html

code:

var send_to_url = 'http://localhost:8000/Main/test/xmlhttprequest/';
//var send_to_url = 'http://tipjoy.com/api/tweetpayment/';
//var text = 'p 1¢ @cwallardo testing';
var text = 'p something to cwallardo test';
var params = 'twitter_username='+escape('someusername')
+'&twitter_password='+escape('somepassword')+'&text='+escape(text);

GM_xmlhttpRequest({
method: 'POST',
url: send_to_url,
data:
'twitter_username=someusername&twitter_password=somepassword',
headers: {
"User-agent": "Mozilla/4.0 (compatible) Greasemonkey",
"Accept": "application/atom+xml,application/xml,text/xml",
"Content-type": "application/x-www-form-urlencoded",
"Content-length": params.length
},
onload: function(r) {
GM_log('xmlhttpRequest worked '+r.status+' '+r.responseText);
},
onerror: function(r) {
GM_log('xmlhttpRequest failed');
}
});

I'm running FF3 on MacOsX.

What I'm doing on my server, in case it is happening to bypass some
fatal flaw in my javascript, is:
1. handle request in Django
2. make twitter call using python twitter.py wrapper
Api(request.POST['twitter_username'], request.POST
['twitter_password']).PostUpdate('hello world')

I'm still learning javascript/ajax, so if you advice for encoding
(escaping?) javascript POST data, especially the cent symbol, I'd be
happy to hear it :-)

Thanks,
Lucy.

[Ivan Kirigin]

Hi Lucy,

I just pushed a fix which might solve some of the intermittent
"invalid password" returns. The problem probably occurred for accounts
that had OAuth-ed, and using the API for the account needed to ping
Twitter to test the credentials.

Let me know if you're still having problems.

I'm also somewhat a newb with javascript. I've found http://jquery.org
to be invaluable, and their ajax tools are really helpful.

You can escape the cents symbol using encodeURIComponent, I think. Let
me know if that is getting garbled through tipjoy.

To do the escaping in Python, I recommend encoding to utf-8 and then
using urllib.quote, e.g.
urllib.quote(value.encode('utf8'), safe='~')

Ivan
http://tipjoy.com

[lucy]

Ivan,

Hmmm, I'm still getting "invalid password". I've tried with a couple
different accounts with an eye for intermittedness. Nothing seems to
get through.

I'm changing tactics, though (for other reasons). So I'll let you know
if I continue to have problems.

I heart jquery!! That's why I consider myself a javascript newb :-) I
went ahead and loaded jquery into my ff extension javascript files:

// Add jQuery
var GM_JQ = document.createElement('script');
GM_JQ.src = 'http://jquery.com/src/jquery-latest.js';
GM_JQ.type = 'text/javascript';
document.getElementsByTagName('head')[0].appendChild(GM_JQ);

function GM_wait() {
if(typeof unsafeWindow.jQuery == 'undefined') { window.setTimeout
(GM_wait,100); }
else { $ = unsafeWindow.jQuery; }
}
GM_wait();


It's adapted from a jquery/greasemonkey blog post I read a year or two
back. After assigning $, one is supposed to make calls to a function.
I don't think it matters, but the firefox extension I'm cribbing off
of could stand to be refactored anyway. (I'm totally overwhelmed by
XUL, but hopefully making progress).

On Apr 13, 9:21 am, Ivan Kirigin <ivan.kiri...@gmail.com> wrote:
> Hi Lucy,
>
> I just pushed a fix which might solve some of the intermittent
> "invalid password" returns. The problem probably occurred for accounts
> that had OAuth-ed, and using the API for the account needed to ping
> Twitter to test the credentials.
>
> Let me know if you're still having problems.
>

> I'm also somewhat a newb with javascript. I've foundhttp://jquery.org

> to be invaluable, and their ajax tools are really helpful.
>
> You can escape the cents symbol using encodeURIComponent, I think. Let
> me know if that is getting garbled through tipjoy.
>
> To do the escaping in Python, I recommend encoding to utf-8 and then
> using urllib.quote, e.g.
> urllib.quote(value.encode('utf8'), safe='~')
>

> Ivanhttp://tipjoy.com

[lucy]

More to the point:

Is it possible to POST data to TipJoy from javascript injected while a
user is viewing some other domain?

I'm trying to write a firefox extension that makes calls to TipJoy's
payment API while a user browses. (Idea #2, perhaps, Ivan? I'm gunning
for that macbook air sooo hard, so I hope I learn how to implement my
(awesome@#!) idea before it gets swiPPed!)

I'd wanted to keep a user's twitter password safely in their browser
rather than my server.

Now I realize there are all sorts of security problems with POSTing
from javascript to a different domain. I'd used padded json in the
past to get around cross site communication, but that circumvents
XmlHttpRequests all together.

GETting a user's twitter password to my own server and then making the
API call serverside is fine, other than transmitting a password over
GET! That would be bad, right? or is GET no less secure than POST?

I could encrypt the password first, with only my server having the
private key.

Or...I could store twitter passwords and whatnot on my server. :(

Any ideas? Have I misunderstood the problem space?

Thanks for your help! Did I mention how excited I am over building a
TipJoy app!!!

Lucy.

[lucy]

Hmmm...I'm not sure that storing passwords on my server, with the
user's browser extension periodically signaling my server to make a
payment, is a viable option. How do I authenticate the signal? Seems
kind of insecure.

Here's a solution:

A user's browser records the payments it wants to make.
The user then browsers to my domain
Where a POST to my server can now take place
(the POST contains the user's twitter password so that my server can
do all the API calls it needs to do without having stored the twitter
password)

I guess that will work, other than adding an onus for users to browse
to my domain.

Hmm...in javascript can't I force a user to navigate to a particular
page by setting href.location? So then can't I force them to
essentially complete the POST to my server?

When someone downloads my FF extension they overtly trust it. Why
can't they also trust it to POST to alternate domains? Perhaps this is
not impossible afterall?

L.

On Apr 13, 9:55 pm, lucy <a.downy.h...@gmail.com> wrote:

[lucy]

answered here:

https://developer.mozilla.org/en/Extension_Frequently_Asked_Questions#I_cannot_initiate_an_XMLHttpRequest_from_my_extension

"You need to make sure that you are initializing the cross domain
XMLHttpRequest from JavaScript code that is referencing a XUL window.
If you try and execute the request in relation to the browser content
document, as opposed to the "document" of the XUL window, you will
receive a Permission Denied error."

[lucy]

ps - it's easier to include jquery directly in overlay.xul, or
whatever your chrome.manifest points to. you know, where the rest of
the <script> tags are...

before i build something myself, that thing seems so confusing and
magical. afterwards, building it seems like the most obvious thing in
the world.
(this is still wishful thinking in the case of understanding the
firefox ecosystem. right now i'm sacrificing goats to the XUL gods.
that usually means it's time for bed.)

On Apr 13, 11:51 pm, lucy <a.downy.h...@gmail.com> wrote:
> answered here:
>
> https://developer.mozilla.org/en/Extension_Frequently_Asked_Questions...

[Ivan Kirigin]

Yes, I thought this might be an issue, related to the browser blocking
cross domain POSTs.

I might have a solution. I'll try to code up some jquery, and post the
code. It should be available later this week.

Ivan

[lucy]

Ivan,

I apologize for the wild goose chase. POSTing through a firefox
extension is entirely possible --in fact I do so in the example that
starts this thread. I got distracted by wondering how it worked.

Anyway, XmlHttpRequest land from XUL/FF extn is totally cool -- in
fact I've been POSTing to the TipJoy API without problem. The only
problem I do have is that I can only use twitter user and password
pairs for twitter users whose TipJoy accounts I created through the
TipJoy API.

I created diN0bot through the TipJoy website. Whenever I do a POST to
TipJoy with diN0bot as the username, i get an invalid password
problem.

I created Weatherizer through the create account API method, and I
have had no problems making payments from weatherizer (other than not
yet being brave enough to send 5 cents to myself).

Do you think the password problem is on my end or a bug in the TipJoy
API?

Lucy.

On Apr 14, 9:59 am, Ivan Kirigin <ivan.kiri...@gmail.com> wrote:
> Yes, I thought this might be an issue, related to the browser blocking
> cross domain POSTs.
>
> I might have a solution. I'll try to code up some jquery, and post the
> code. It should be available later this week.
>
> Ivan
>

> On Mon, Apr 13, 2009 at 11:51 PM, lucy <a.downy.h...@gmail.com> wrote:
>
> > answered here:
>
> >https://developer.mozilla.org/en/Extension_Frequently_Asked_Questions...
>

[lucy]

Ivan,

Woo! I tipped you $1, twice.

I still can't seem to tip cents. It keeps reporting "missing target":
{"reason": "missing target", "request": "/api/tweetpayment/",
"result": "failure"}

The text parameter contains this:
'p 2¢ @ivankirigin for testing 1..2..3...';

I have tried using the raw text, encodeURIComponent(text) and escape
(text). When I paid @ivankirigin $1, escape(text) worked (didn't try
the other options though).

Here is what the text looks like in these different formats:

text p 2¢ @ivankirigin for testing 1..2..3...
encURI p%202%C2%A2%20%40ivankirigin%20for%20testing%201..2..3...
escape p%202%A2%20@ivankirigin%20for%20testing%201..2..3...

Essentially, the cent symbol is being encoded as %A2. URI encoding
also encodes the @.

How are things supposed to look on your end? Can you confirm using the
TipJoy api with cents?

Thanks,
Lucy.

[Ivan Kirigin]

I think this is a bug in our API, and I'll look into it today.

Also, I'll try to get an example and testing for the cents issue.

We're about to make live a test for credit card support. That's what
we've been working on urgently because of a recent PayPal outage.

Check this out in a few hours, and let me know if you have any problems:
http://tipjoy.com/ccpay

Ivan
http://tipjoy.com

[lucy]

Ivan,

Dealing with the PayPal outage is obviously more important :-)
Adding credit card support is a good idea, regardless.

I get cent problems from python, too. Also, I can only post from an
account that I created via the API not the web.

Variations on the following theme:

def _POST(url, values):
"""
POSTs values to url. Returns whatever url returns
"""
data = urllib.urlencode(values)
req = urllib2.Request(url, data)
response = urllib2.urlopen(req).read()
return simplejson.loads(response)

def make_payment():
text = u"p 5\u00A2 @diN0bot from python"
text = urllib.quote(text.encode('utf8'), safe='~')
values = {'twitter_username': XXXX,
'twitter_password': XXXX,
'text': text }
url = "http://tipjoy.com/api/tweetpayment/"
print _POST(url, values)

Thanks for the status reports. It'd be good if the bugs get fixed in
the next week or two. I'll try to hammer out my actual firefox
extension in the meantime before knocking on your door again :-)

Lucy.

ps - If there are any devs in the Cambridge, MA area who want to
collaborate please let me know. I love working together. Indicate
whether you're interested in being an experienced mentor/problem
solver, or a substantial collaborator (coding and/or design).

On Apr 15, 3:27 pm, Ivan Kirigin <ivan.kiri...@gmail.com> wrote:
> I think this is a bug in our API, and I'll look into it today.
>
> Also, I'll try to get an example and testing for the cents issue.
>
> We're about to make live a test for credit card support. That's what
> we've been working on urgently because of a recent PayPal outage.
>
> Check this out in a few hours, and let me know if you have any problems:http://tipjoy.com/ccpay
>

> Ivanhttp://tipjoy.com

[Ivan Kirigin]

Lucy,

We just updated things on our end. Can you test if the invalid
password issue is solved for you?

Thanks.

Now I'm going to test the cents issue.

BTW, I'm publicly posting my todo list:
http://bit.ly/f37W8

Ivan
http://tipjoy.com

> ...
>
> read more »

[lucy]

Ivan,

Unfortunately, I now get this response:

{"reason": "tweet failed", "request": "/api/tweetpayment/",
"result": "failure"}

works when I use 'weatherizer', which I created using API. fails when
changed to 'diN0bot', which I created via the web.

BTW, I tried commenting on your todo blog post, but the system told me
my username needed at least 3 characters, even though I had filled out
the "unclaimed" comment form appropriately.

L.

On Apr 17, 11:00 am, Ivan Kirigin <ivan.kiri...@gmail.com> wrote:
> Lucy,
>
> We just updated things on our end. Can you test if the invalid
> password issue is solved for you?
>
> Thanks.
>
> Now I'm going to test the cents issue.
>
> BTW, I'm publicly posting my todo list:http://bit.ly/f37W8
>

> Ivanhttp://tipjoy.com

> ...
>
> read more »

[Ivan Kirigin]

Solved. This was indeed an issue just for oauth accounts.

Lemme know

Ivan

[lucy]

Ivan,

BTW - tweet failed does not mean the payment failed. TipJoy payment
works. The tweet failure may be because when I created the tipjoy
accounts using the web, I did so through the Twitter OAuth option
(doh!).

Then I created an account with a different username and password than
the twitter account I later OAuthed through the settings.
{"reason": "invalid twitter_password", "request": "/api/
tweetpayment/", "result": "failure"}

Finally, I created an account with username and password exactly
matching the twitter account, and then OAuthed tipjoy to access that
account. It works!

In conclusion, things are working pretty well right now. I hope to
have a beta working by early next week, which will likely come with a
slew of new situations and problems.

Lucy.

> ...
>
> read more »