Support OTP in Browserpass v3
See original GitHub issueOTP was intentionally not re-implemented in Browserpass v3, but given that some of you might want to implement this functionality as a fork or extension to Browserpass, let’s coordinate this effort to prevent duplication and fragmentation of your work.
Creating a separate browser extension that will also talk to Browserpass native host is always an option, although it has its drawbacks.
However after reading your feedback in #322 and #331, @erayd came up with the following neat idea and convinced me to agree to it:
- Create a new dedicated extension
browserpass-otp
in the Browserpass org - Browserpass v3, upon receiving a decrypted password entry from the native host, will see if there is an OTP URL or seed, and if so, will automatically hand this value off to
browserpass-otp
extension (if it is installed). browserpass-otp
is then free to do anything it wants with the OTP url, it can generate codes, show them on the page, insert in the form, copy to clipboard, etc. - the limits are only your imagination 😉
This approach has the following benefits:
- No need to communicate with native host at all.
- No need to select pass entry twice in the popup (as it would have been the case for two extensions that are unaware of each other).
- This extension will only have access to OTP url, but not the rest of the pass entry contents.
- We can always revoke the communication between browserpass and browserpass-otp if the latter does something terrible.
At the same time I’m satisfied by the minimal impact on Browserpass extension:
- No OTP-related code in Browserpass codebase
- No mention of OTP in UI, not even hidden in settings
- Still recommend against storing OTP codes in password store
I’m not planning to contribute much code to browserpass-otp
myself, but because this will be a whitelisted extension in Browserpass, I would like to establish the following requirements:
browserpass-otp
must belong to Browserpass org on Github- The entire development must be done via pull requests
- @erayd or I must approve every PR
Question to community:
Who is interested to write code for browserpass-otp
extension? Please speak up.
And as usual, please share any feedback you have, if not for your comments in #322 and #331, we would not be discussing this at all 😉
Issue Analytics
- State:
- Created 4 years ago
- Reactions:13
- Comments:18 (3 by maintainers)
I have now published the OTP extension in the Firefox and Chrome extension webstores.
This is a very, very, extremely, don’t-rely-on-it-for-anything, dev release… but it works, and it’s now available for those who really want OTP functionality right now. Please pay close attention to the following caveats:
Expect to see a number of updates over the next few days as development continues. Feedback is welcome - please contribute your comments, ideas, criticisms, wishlists etc. over at the browserpass-otp project repository.
It wasn’t reimplemented into the new extension, therefor the functionality was taken away.