Pretty Good ID - Password replacement

[Andrew Lee]

Any chance PGID will support Firefox?

I am hoping someone will pick it up. Since FF extensions are also written in JavaScript, most of the code should be portable, except for the plumbing. Should be a good exercise in writing FF extension!

On another note, since Opera 15 is now based on Chromium, the Chrome extension should work with little or no modification.

I am now focusing my time on writing a PGID mod for phpBB.

[Andrew Lee]

For those of you who thought I was done on this topic, well I'm back.

Initially I wanted to start working on server-side PGID authentication plugins for phpBB, then Wordpress. But I got side-tracked.

I started wondering if PGID can be supported on mobile browsers. So I did a little bit of research, and it was quite a letdown that I found out Chrome on mobile devices does not support extensions (yet).

Fortunately, Firefox on Android (codename: Fennac) does, so I started to prototype an addon for it.

To my pleasant surprise, it works! And quite a bit of non-UI code could be shared with the Chrome extension.

Once the Fennac code was done, it was quite straightforward to port the addon to Firefox (desktop), where I found even more of the code (now the UI bits) could be shared with the Chrome extension.

So there we are. PGID support for Chrome, Firefox and Firefox Mobile!

I have also mobile-enabled the main and demo sites using Bootstrap, so they render better on mobile devices.

The Chrome extension is now officially available on the Chrome Web Store.

The Firefox addons are still undergoing the review process, which I must say is a royal pain the a** compared to the Chrome submission process. So I have attached the respective XPI files with this post so you can try them out.

Video clips of the extension/addons in action are also available on YouTube for Chrome, Firefox and Firefox/Android.

Github will be updated once I finish readme.md documentation.

Attachment: Firefox addon
Attachment: Firefox/Android addon

[romulous]

The Firefox addons are still undergoing the review process, which I must say is a royal pain the a** compared to the Chrome submission process.

Browser add-on's are one of the more important vectors for attack for malware authors now. If Google's Play store is any guide to their Chrome store, it is probably infested with add-on's that steal your personal data (and Google does not give a toss). Firefox's process may be clunky - but it appears to work. To my knowledge, they have not had the same amount of breaches (malware infested add-on's) land in their add-on store that Chrome has.

romulous

[joby_toss]

@Andrew: any direct download link for the Chrome plugin?

[Andrew Lee]

Here it is: Chrome addon

[Andrew Lee]

Just came to my attention that there is a similar idea called SQRL (Secure Quick Reliable Login):

https://www.grc.com/sqrl/sqrl.htm

There are many similarities, but also differences (eg. using curve digital signature to reduce the number of bits required for the key). I am still reading up on it.

It is still very new. There are a few pre-alpha implementations of it, both on the client and server side.

[Andrew Lee]

I am very impressed by SQRL. It has the following additional pluses over PGID:

- It generates a different public/private key for each domain based on the original key. Hence when a web service is hacked, the public key exposure has zero value to the hacker 'cos even if it can be factored with a brute-force attack, the private key so obtained cannot be used for another site.

- Key change is seamless to the user. If the original key is compromised, a rescue code created during key generation can be used to create a new key. Then when you login to the website, the old key will automagically be updated to the new key. The attacker, without your rescue code, cannot update the original key.

- It has additional features to guard against phishing and man-in-the-middle attack. I don't think any scheme can completely guide against human stupidity, but I think the features in SQRL are a nice compromise between simplicity and usability.

Given this new info, I don't think there's any reason for me to continue working on PGID. My efforts are better spent helping out with SQRL in whatever ways I can. I can't wait for the specs to be finalized and for more websites to adopt it. I really think username/password is an abomination that needs to die.

There's a nice illustrated guide to SQRL here:

http://www.sqrl.pl/

It's extremely easy to test it out with an Android client and various test sites:

- https://sqrl-login.appspot.com/
- https://sqrl-test.paragon-es.de/

No native Win32 implementation yet as far as I can tell. Maybe that's what I should be working on. A portable WIN32 SQRL client.

[Midas]

FTR, there's recent mini-survey of related projects at the TinyApps.org blog:

• Time to replace traditional password managers...
  http://tinyapps.org/blog/misc/201506260 ... rator.html

[Specular]

+1 for any SQRL clients

[Andrew Lee]

I am still following the sqrl discussion closely. I hope we will see a 1.0 release of the specs soon. Then the various clients can catch up, and I can try to implement it for TPFC.