Browser Extensions

[saswatasarkar13]

Browser Extensions Like

• Firefox
• Brave (Chromium)

[ua741]

After adding web access (https://auth.ente.io), this will be a low-priority item for us. If anyone in the community wants to create an extension, please feel free to reach out to us on Discord or Matrix.

The extension will only be valuable if it can auto-fill the codes, either automatically or with a minimum number of clicks.

[fr-gg]

In my opinion this isn't really needed, 2FA will be more secure if you only use it on mobile. Auth on the web is useful in case your phone breaks, and you need to have access to your accounts.

[DennisGaida]

Valid opinion. I would love an extension for convenience. There are password managers integrating 2FA left and right and we choose to not use these integrated solutions and go for another solution such as Ente Auth because of exactly that: security. Separating password manager and 2FA into two totally different apps makes it more secure.

Would a browser extension open up the attack surface to Ente Auth? Sure in some way. Ultimately it would be totally fine to just have the extension wrap the web site and and let me choose to fill 2FA codes automatically instead of me having to type stuff. So in terms of attack surface the browser extension is pretty much the same as opening the web site. There may be one attack vector like sites trying to steal your 2FA codes by mimicking other sites and the browser extension would make it easier to be duped by such sites - but in the end this is very similar to manually entering the 2FA codes on those sites.

Again: Valid opinion. I get where you are coming from. Personally I would love an extension for convenience - we're "only" talking TOTP codes here, not Password & TOTP. One is useless without the other.

[ashutoshsaboo]

I concur completely with the @DennisGaida 's thoughts above. An extension (all it has to majorly do is to be able to autofill 2fa codes) would definitely be helpful for user convenience.

[chakibchemso]

i agree with @DennisGaida too.

[Stupidboat]

There may be one attack vector like sites trying to steal your 2FA codes by mimicking other sites and the browser extension would make it easier to be duped by such sites - but in the end this is very similar to manually entering the 2FA codes on those sites.

i feel it could work in the opposite way, you could configure ur 2fa to only recognise a specific link so that in theory the extension could indicate if the site is a known 2fa website or not and either refuse or give a warning before allowing you to input ur code

[nathfavour]

Is there anyone working on this already, or can I take it up?

[kitallis]

Happy to help with this @nathfavour, if this is something you're taking up. I'm used to using this.

P.S: I'm @kitallis on Discord.

[ashutoshsaboo]

Are either of you planning to build this extension? @nathfavour @kitallis I can help with testing if needed. Would find it super useful if a chrome extension can be built! I'm sure many others would also find it equally useful 🚀

[nathfavour]

LFG ;)

…

On Wed, Oct 2, 2024, 11:42 AM Akshay Gupta ***@***.***> wrote: Happy to help with this @nathfavour <https://github.com/nathfavour>, if this is something you're taking up. I'm used to using this <https://authenticator.cc>. P.S: I'm @kitallis <https://github.com/kitallis> on Discord. — Reply to this email directly, view it on GitHub <#1041 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A3ZDBOY4GVOFIMIZLGFXGI3ZZPEYJAVCNFSM6AAAAABESHT6K2VHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTAOBRHEYDCNY> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[nathfavour]

Yes, I am!

…

On Mon, Oct 28, 2024 at 6:19 PM Ashutosh Saboo ***@***.***> wrote: Are you planning to build this extension? @nathfavour <https://github.com/nathfavour> I can help with testing if needed. Would find it super useful if a chrome extension can be built! — Reply to this email directly, view it on GitHub <#1041 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A3ZDBO2R6P5GLEBMAYUDPCTZ5ZW3RAVCNFSM6AAAAABESHT6K2VHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTCMBXG43DSNY> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[dnet890]

Browser extension also good. So, we can autofill our OTP or filled the OTP manually like Bitwarden or Proton pass