1y ago

uOTP : simple TOTP extension for firefox

addons.mozilla.org

uOTP – Get this Extension for 🦊 Firefox (en-US)

cross-posted from: https://lemmy.ml/post/12744832

As I updated the version to 1.4.0 , adding the 'import' feature I am sharing this here.
I made this extension because I couldn't find one that wouldn't ask for too much permissions (such as accessing all websites data).
Eventually I found it nice to have a TOTP that can really be audited, the code is 649 lines of JS, 214 CSS and 52 HTML. Feel free to fork, copy part of it, contribute or just request fix/features.
I have used it for more than a year every day and it works nicely.

Open Source @lemmy.ml

AYO_Official @lemmy.ml

1y ago

uOTP : simple TOTP extension for firefox

addons.mozilla.org /en-US/firefox/addon/uotp/

29 comments

I struggle to think of a situation where I would willingly undermine TOTP security by storing the secrets in my web browser.
Before using this for anything you can't afford to lose, I suggest thinking twice. And then twice again.
Edit to elaborate:
Web browsers are probably the single most targeted component in a desktop computer, have an enormous attack surface, and suffer from an unending stream of vulnerabilities and exploits discovered practically every month. Storing your 2FA secrets there is akin to putting a second lock on your door and hiding the key under the doormat.
And no, encrypting the secrets in the browser for storage-at-rest does not solve this problem, because it also delegates decryption to the browser. That means an exploited browser can access all of your secrets as soon as you request a TOTP from any of them. Closing it won't help, because an exploited browser can trivially save or give away a copy of the password you entered, or the decryption key that was generated from it, or the secrets themselves, so your secrets are then compromised forever.
2FA generators are generally built as stand-alone programs for good reason. Even the ones that offer a browser extension don't let it access the secret storage.
Really, think twice before depending on this design for anything important.
- It's also an extension with 1 review, by a no-name developer, with only 12 installs... definitely would trust that...
  
  Well this is 600 lines of code, if you cannot audit that you can indeed ignore it for now. Once again this is the only auditable code out there and not asking for unrelated permissions.
  
  Every software started with 0 reviews, by a no-name developer, with only 1 installs.
So basically... completely remove the purpose of 2FA?
- Does it, tho? It's like "smth you know + smth you have" (although knowing or being able to remember most paswords is also quite often a bad idea, but I digress); so you have a device and know [the password for the password manager which knows] the password.
  Besides, given that logic, to not defeat the purpose of 2fa you'll have to have another smartphone just to run aegis or something
  
  There is an irony in password managers that stores your password but need a password (passphrase would be better). A password for your passwords. Fundamentally this is because the only secured space, only you can get in and no one else, is your own brain.
  Most password leaks are usually caused by bad implementations on the server side. I have an authentication protocol to avoid many password leakages I'd like to share one day (double salt, one from client, one on server so password is never shared to the server).
- No it doesnt, it is a password and a secret stored on that device. A password might get stolen on the database, or entered on a fishing website, but with 2FA that would be useless.
  It goes against ONE idea of 2FA, that phones are more secure (thanks Android) and your Browser might get hacked.
  
  If your computer gets compromised and you store your passwords on it (as most do) then you are also storing your 2fa on it, then there is no 2fa.
  
  Even if it's not more secure it's extra effort nevertheless. But as you said even without that it still removes an entire vector of attack
Really cool! How is the database stored, can it be encrypted using the masterpassword, or a different one? Can it be only loaded into RAM?
On traditional desktops like any app can read your browser data, which would be very problematic.
- Database is encrypted in the local storage of the extension. So far Firefox is secure enough so this is not accessible from outside (it is encrypted anyway). The encryption is using the crypto web API (native from web browser) to use PBKDF2 key. It is decrypted with your password so the database is in RAM (not saved anywhere unencrypted) as long as the browser is open or you click to "logout".
  You can export/import all the entries with a simple JSON format (for now, simple "name"+"secret" for each entry). You should encrypt this export file or save it in a encrypted volume yourself.
  
  Very neat, thanks!

29 comments